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SUMMARY 


This  report  contains  the  studies  which  treat  various  problems  concerning 
disaster  mitigation  and  civil  defense  with  the  formal  methodology  of  systems, 
the  HOS  methodology.  Included  are  restricted  inquiries  concerning  trans¬ 
portation,  communication  and  goal  analysis.  The  more  extensive  results 
present  1)  an  integrated  host  and  risk  area  system  for  relocation,  using 
relocation  of  industrial  personnel  as  a  test  bench  for  the  applicability 
of  HOS  methodology  to  a  problem  which  is  a  general  one;  2)  a  specification 
of  place  as  a  data  type  and  a  primitive  or  basic  operation  for  locating 
one  object  in  relation  to  another,  which  are  prerequisites  for  dynamic 
mapping,  planning,  and  implementation  of  mitigation  systems. 

The  results  obtained  indicate  that  the  HOS  methodology  can  be  employed 
in  the  design  of  systems  pertinent  to  the  mitigation  environment.  Evi¬ 
dence  for  this  conclusion  includes  (a)  the  design  of  an  integrated 
system  using  stated  goals  and  available  information;  (b)  the  description 
of  the  system  includes  inputs,  outputs,  and  functions  in  natural  lan¬ 
guage  utilized  by  planners,  operators  and  participants  in  the  mitigation 
environment;  (c)  the  integrated  system  includes  some  clear  cut  require¬ 
ments  which  the  HOS  staff  finds  absent  in  the  current  treatments  of  miti¬ 
gation  and  nuclear  war  preparedness  planning;  (d)  the  methodology  can 
be  used  to  capture  very  fundamental  operations  which  are  common  to  a 
variety  of  problems  which  appear  only  on  the  surface  to  present  quite 
different  difficulties;  (e)  the  design  included  provision  for  the  be¬ 
ginning  of  defining  surge,  the  transition  to  activation  of  plans  and 
execution  of  plans. 

In  addition  to  these  studies,  HOS,  during  the  tenure  of  the  contract  also 
carefully  considered  what  specific  recommendations  can  be  made  to  en¬ 
hance  disaster  mitigation  planning  and  execution  on  the  basis  of  its 
experience  with  the  system  and  its  environment. 
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The  most  important  and  direct  finding,  however,  is  that  by  employing  the  HOS 
I  methodology,  it  should  be  possible  to  design  testable  systems  for  a  var¬ 

iety  of  responses  to  a  variety  of  crises  and  disasters.  The  method¬ 
ology  is  rigorous  enough  to  deal  with  the  enormous  difficulties  in  terms 
of  complexity  and  uncertainty  and  to  retain  sufficient  flexibility  to 
I  respond  in  real  time  to  changing  situations. 
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INTRODUCTION  AND  RECOMMENDATIONS 
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INTRODUCTION  AND  RECOMMENDATIONS 

*  This  investigation  was  concerned  with  examining  the  applicability  of  a 

formal  system  methodology,  the  HOS  methodology  to  the  civil  defense  en¬ 
vironment.  After  a  period  of  learning,  the  HOS  staff  attempted  modest 
design  efforts.  These  efforts  were  extremely  importatnt  in  proceeding 
1  to  the  more  interesting  and  demanding  design  work.  Using  industrial 

relocation  as  a  test  bed,  an  integrated  system  was  designed  and  a  de¬ 
tailed  description  of  an  important  data  type,  place,  was  completed. 

f  To  our  knowledge,  this  is  the  first  time  that  a  formal  methodology  with 

the  characteristics  of  the  HOS  methodology  has  been  employed  in  the  civil 
defense  environment.  On  the  basis  of  our  experience,  crucial  issues 
^  such  as  identifying  important  information,  sequence  and  priority  of  ac¬ 

tivities,  decision  making  and  identification  of  possible  performance 
indicators  are  the  most  obvious  benefits  from  using  the  HOS  approach. 
These  benefits  are  achieved  using  natural  language  and  thus  the  approach 
can  be  used  by  planners. 

> 

The  integrated  system  for  relocation  specifically  deals  with  the  major 
issues  and  provides  for  correct  interfaces.  The  work  dealing  with  the 
^  description  of  the  data  type  place  is  an  example  of  how  a  very  basic 

notion  common  throughout  the  civil  defense  environment,  can  be  defined. 
The  detailed  definition  is  provided  to  provide  FEMA  with  a  rigorous 
account  of  how  such  basic  definitions  are  achieved. 

» 

Finally,  it  weems  worthwhile  to  provide  a  few  modest  recommendations 
based  on  our  experience  with  these  design  efforts. 

I.  A  systematic  treatment  allows  FEMA  to  pull  together  very 
»  diverse  functions  and  problems.  We  recommend  application 

of  such  an  approach  to  fully  utilize  the  expertise  available 
in  FEMA. 
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Once  a  goal  has  been  selected,  support  the  plan  for  that 
goal  with  a  visible  and  systematic  route,  showing  inputs, 
outputs,  functions,  and  connections  between  parts  of  the 
system  very  clearly. 

Subject  plans  in  hand  to  a  systematic  examination,  using 
experience  with  disaster  response  to  aid  the  systematic 
examination. 


SECTION  II 
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CONSIDERATION  OF  SOME  GOALS  FOR  DCPA 


This  paper  concerns  the  goals  of  a  DCPA  system  based  on  material  thus  far 
examined  by  HOS  and  a  visit  to  Region  1.  It  seemed  appropriate  to  describe 
some  goals  at  this  time  so  that  as  the  various  system  characteristics  of 
civil  defense  become  evident  and  then  defined  by  HOS  methodology,  it  would 
be  feasible  to  investigate  how  well  they  were  defined  and  how,  in  general, 
certain  of  them  interface  in  DC  systems  in  general.  In  addition,  as  various 
goals  for  CD  become  apparent  and  the  resources  and  operations  required  for 
them  become  identified,  it  will  be  possible  to  relate  various  separate 
goals  in  a  consistent  way,  thus  providing  a  degree  of  versatility  for  systems, 
and  to  identify  goals  which  are  inconsistent  or  redundant. 

It  is  also  apparent  both  from  the  historical  record  [1]  and  legislative 
support  of  civil  defense  [2]  that  goal  setting  in  regard  to  civil  defense 
is  a  policy  decision,  made  by  elected  officials,  seemingly  a  process  quite 
apart  from  the  technical  ones.  It  must  be  recognized,  however,  that  in 
the  case  of  civil  defense  technology  and  political  decision  making,  i.e., 
should  we  have  a  civil  defense  system  and  what  it  should  do,  are  not  dis¬ 
tinctive.  Civil  defense  can  be  considered  a  passive  measure  of  defense, 
focusing  on  the  saving  of  lives  in  the  case  of  war  or  disaster.  In  the 
case  of  war,  the  battle  at  Waterloo  can  be  regarded  as  the  last  instance 
in  which  the  population  and  their  resources  were  not  regarded  as  "combatants." 
Subsequently,  as  the  role  of  the  individual  soldier  became  increasingly 
supported  by  technology,  the  industrial  and  economic  base  capable  of  supplying 
the  technology  and  thereby  waging  war  became  combatant  and  targets  of  value. 
Thus,  in  addition  to  and  perhaps  in  some  instances  only  secondarily  [3], 
is  the  saving  of  "civilian"  lives  and  resources  a  process  carried  out  for 
humanitarian  reasons.  In  fact,  the  population  is  required  to  participate 
to  varying  degrees  to  support  achievement  of  military  objectives.  Thus,  a 
decision  to  have  a  civil  defense  system,  given  the  current  means  by  which 
war  and  attacks  are  carried  out,  can  be  a  decision  to  attempt  to  protect, 
defend,  and  recover  military  capability.  In  the  case  of  the  United  States, 
the  war  of  1812  was  the  only  instance  in  which  the  threat  directly  affected 
the  population;  in  the  modern  era,  the  entire  country  can  be  regarded 


» 


as  threatened  in  a  very  direct  way.  An  attack  solely  on  purely  military 
targets,  if  that  were  tactically  possible,  would  not  eliminate  completely 
the  defensive  and  offensive  abilities  of  the  nation.  Accordingly,  HOS 
has  examined  and  considered  goals  described  in  the  literature  to  determine 
if  the  goal  of  civil  defense  had  been  or  can  be  clearly  defined.  Without 
a  clear  statement  on  this  matter,  the  technical  issue  of  designing  a  system 
or  examining  proposed  or  existing  systems  cannot  be  effectively  addressed. 

For  example,  if  the  goal  is  to  save  lives,  the  system  would  possess  features 
which  would  specifically  reduce  fatalities.  If  the  goal  is  to  save  lives  and 
j  provide  a  means  to  recover  the  national  welfare,  the  addition  of  whatever 

follows  the  "and"  affects  how  and  under  what  circumstances  resources  are 
directed  to  save  lives  along  particular  constraining  lines.  Regardless 
of  what  follows,  the  "and",  whether  explicitly  or  implicitly  given,  in 
j  effect  defines  the  system  directed  at  its  achievement.  The  technology 

of  systems  in  the  case  of  civil  defense  evolves  and  is  to  a  great  extent 
an  extension  of  the  political  decision.  Indeed,  as  we  progress  in  our  work 
on  modeling  civil  defense  systems,  determination  of  what  happens  to  be 
j  inputs  given  stated  constraints  will  aid  those  vested  with  the  responsibility 

of  political  decision  making.  An  example  of  a  current  instance  where 
technology  and  politics  merge  is  in  the  search  for  secure  and  trustworthy 
ways  to  monitor  Soviet  and  U.S.  compliance  with  arms  limitation  agreements. 

* 

The  Federal  Civil  Defense  Act  of  1950  (as  amended)  aims  at  protection  of  life 
and  property  against  enemy  attack.  The  definition  of  protection  as  far  as 
DCPA  is  concerned  does  not  extend  to  measures  for  recovery,  but  rather  is 
I  the  apparent  responsibility  of  other  Federal  agencies.  The  definition  of 

attack  is  now  broader  than  in  1950. 

The  following  list  of  goals  for  a  CD  system  have  been  extracted  from  a 
I  variety  of  sources.  They  are  not  mutually  exclusive  and  assume  that  both 

the  U.S.  and  at  least  one  potential  adversary  have  the  military  capability 
in  number  of  warheads,  launchers,  reliability  of  weapon  performance,  and 
accuracy  cited  in  the  literature  [4,5,6]. 
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Goals: 


1.  minimize  fatalities  in  a  nuclear  war  [7]. 

2.  to  provide  a  U.S.  counter  to  an  adversary  CD  operation  (e.g.,  crisis 
relocation)  to  be  used  in  crisis  negotiations  (the  bargaining  chip 
goal)  or  reflection  of  gravity  of  situation. [1]. 

3.  to  offset  a  fatality  disparity  between  U.S.  and  adversary  (equalize 
hostage  taking)  [1]. 

4.  to  enhance  or  maximize  war-fighting  (defend  and  win)  effort  (live  to 
fight,  survive  to  win  [3].) 

5.  to  project  a  firm  image  of  resolve  to  Allies  [8]. 

6.  to  provide  reduction  in  fatalities  due  to  radiation  resulting  from 
nuclear  war  not  involving  U.S.  in  other  areas  of  the  world  [1  ]. 

7.  to  reduce  fatalities  and  provide  means  of  recovery  for  survivors 
of  a  nuclear  war  [  1  ]. 

8.  to  protect  sufficient  size  of  population  to  provide  option  for  "limited 
nuclear"  war  [ 9  ]. 

9.  to  protect  lives  and  property  from  natural  and  man-made  disasters  [10]. 

10.  to  protect  lives  and  property  from  terrorist  threat  [1  ]. 

11.  to  protect  lives  and  property  from  effects  of  long-term  economic  and 
other  non-violent  crises,  e.g.,  fuel  embargo  [1  ]. 

12.  to  protect  lives  and  property  in  the  event  of  an  "accidental  limited" 
nuclear  attack  on  U.S.  [1  ]. 


Inspection  of  this  short  and  hardly  exhaustive  list  of  goals  prompts 
mention  of  at  least  two  rather  simply  stated  schemes  to  achieve  goals 
1,7,8,12  and  to  some  extent,  2,3,6.  Both  schemes  may  be  considered  diffi¬ 
cult  or  unrealisitic  to  implement: 

I.  Adversary  and  U.S.  disarm  or  limit  both  nuclear  and  conventional 
forces  [11,12]. 

II.  In  the  event  of  a  threat  to  use  nuclear  devices,  which  is  con¬ 
sidered  likely  to  be  implemented  by  an  adversary  of  the  U.S., 
the  U.S.  or  adversary  concedes  to  demands  or  "surrenders"  [13]. 

Scheme  I  is  not  expected  for  some  time.  Scheme  II  appears  unacceptable  to 
U.S.  or  adversary  because  of  the  loss  of  national  identity  and/or  loss  of 
its  ability  to  project  its  power  and  protect  its  interests.  Scheme  II 
appears  to  represent  an  option  likely  to  be  taken  only  when  all  other 
options  are  unavailable. 
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This  exercise  then  has  led  to  the  notion  that  CD  may  have  goals  in  addition 
to  or  other  than  reduction  of  fatalities.  In  the  absence  of  implementation 
I  of  Scheme  I  (an  entirely  reasonable  solution).  Scheme  II  remains  as  the 

only  option  left  to  maximize  survival  and  minimize  fatalities.  It  can  be 
argued  that  a  CD  system  which  is  prepared  to  minimize  fatalities  during  an 
attack  allows,  at  best,  a  chance  to  "win"  and  at  worst  delays  the  time  and 
}  degrades  conditions  of  "concession"  or  "surrender." 

It  must  be  emphasized  that  these  considerations  do  not  necessarily  require 
that  DCPA  alter  its  charter,  but  does  suggest  that  it  is  worth  considering 
what  other  systems  such  as  defense  and  recovery  to  achieve  a  defined 
condition  of  survival  might  interface  with  DCPA  systems  and  how  such 
interaction  would  be  achieved  on  the  part  of  DCPA. 

Analysis  of  the  current  system  of  civil  defense  indicates  that  a  maximum 
of  70%  of  the  U.S.  population  would  be  fatalities  in  an  adversary  nuclear 
attack  [14,15].  Data  drawn  from  a  study  concerned  with  survival  of  re¬ 
located  population  of  the  U.S.  after  a  nuclear  attack  have  indicated  the 
extensive  and  deleterious  effects  of  radiation  on  population  and  food 
supply  and  the  uncertainties  surrounding  the  issues  of  where  and  how 
great  the  radiation  from  fallout  might  be  D9-  A  conservative  considera¬ 
tion  of  the  data  from  [16]  tends  to  increase  the  number  of  projected 
fatalities  from  [14,15]  and  leave  unanswered  the  issue  of  survival  p5]. 

The  current  system  would  appear  to  require  considerable  improvement  ove  * 
many  years  to  reduce  fatalities  and  enhance  survival  [15].  To  relate 
reduction  of  fatalities  and  enhancement  of  survival  to  other  goals,  HOS 
is  in  the  process  of  a  study  of  data  and  analysis  of  survival  of  industry 
and  other  elements. 

To  date,  there  is  no  evidence  available  to  HOS  indicating  that  goals  2,3,8 
have  sufficient  value  relative  to  others  listed  to  warrant  equivalent  priority 
in  systems  design.  Some  goals  would  be  achieved  as  a  by-product  of  other 
goals.  Some  students  of  US  security  have  suggested  that  Soviet  CD  reflects  a 
philosophy  concerning  war-fighting  [4]  yet  the  US  Secretary  of  Defense  did  not 
appear  to  value  the  effectiveness  of  the  soviet  program  to  "enhance  the  prospects 
for  Soviet  society  as  a  whole  following  any  full-scale  nuclear  exchange.  .  ."[8]. 
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Given  the  presumed  inferior  status  of  current  US  CD  (70%  fatalities)  vs  the 
potential  adversary  program  (15-10%)  [14], one  might  expect  this  issue  to  be 
negotiated  or  for  the  US  to  upgrade  its  CD  effort.  But,  thus  far,  the  public 
record  is  devoid  of  reports  indicating  the  bargaining  value  of  CD.  To  what 
extent  CD  maneuvers,  such  as  crisis  relocation  would  be  important  in  crisis 
negotiations  is  not  clear  p5],but  given  the  presumed  perception  of  the 
potential  adversary  as  reflected  in  "best"  Soviet  CD,  a  US  CD  related  to  war¬ 
fighting  (i.e.  increasing  survivors  who  have  resources  to  defend)  would  be  a 
better  candidate  than  one  devoted  to  reduction  of  fatalities. 

The  distinction  between  reduction  of  fatalities  and  enhancement  of  survival  has 
bearing  on  system  features.  For  example,  a  study  of  feasibility  of  CR  [17] 
has  indicated  that  certain  urban  populations  would  relocate  up  to  100  miles 
distant  from  their  cities.  Time,  fuel,  and  population  burdens  were  considered 
carefully  to  minimize  fatalities.  In  a  study  concerned  with  survival  of  the 
relocated  population  D6],  it  was  indicated  that  to  bring  food  and  population 
closer,  relocation  would  have  to  involve  much  greater  distances  than  100  miles. 
It  can  be  argued  that,  as  the  population  exhausted  its  carried  food  supply  [16] 
at  its  relocated  site,  it  would  subsequently  move  in  a  second  relocation  to 
approach  new  food  supplies.  The  second  relocation  might  not  be  feasible  under 
certain  circumstances,  such  as  in  the  aftermath  of  an  "all  out"  nuclear  attack. 
This  would  degrade  survival  and  increase  fatalities.  The  issue  as  to  what 
extent  reduction  of  fatalities  and  survival  enhancement  can  be  complemented 
without  compromising  either. 

Consideration  of  this  example  focuses  attention  on  system  features  which  provide 
interfaces  between  recovery  (or  survival  support)  systems  and  DCPA  systems,  a 
problem  recognized  on  a  somewhat  different  basis  by  others  [13]. 

As  noted  here,  however,  systems  for  reduction  ir  fatalities  and  enhancement 
of  survival  may  be  closely  related  to  a  "war  fighting"  goal,  requiring  inter¬ 
action  of  DCPA  systems  with  defense  measures,  a  requirement  that  has  not  been 
recognized  in  a  recent  reorganization  plan  08],  It  remains  to  be  determined 
to  what  extent  such  interfaces  would  enhance  deterrence,  given  the  absence  of 
schemes  I  and  II,  or  provide  the  basis  for  a  deterrence  of  a  second  order. 
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Goals  9-11,  while  not  related  to  large-scale  catastrophic  environments  as  in 
the  case  of  the  other  goals,  are  concerned  with  events  with  a  slightly  greater 
probability  of  occurring.  Given  the  DCPA  charter  and  the  involvement  of  regional 
offices  in  localities,  the  current  system  appears  to  have  considerable  potential 
for  providing  approaches  to  these  goals. 

Thus  far,  HOS  definitions  of  resources  and  operation  suggest  common  features 
for  systems  devoted  to  goals  9-11  and  others  listed.  The  more  subtle  unique 
features  of  systems  devoted  to  large-scale  catastrophic  events  are  being 
identified  using  a  similar  approach. 
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SECTION  III 


GEOGRAPHICALLY-DISTRIBUTED  SYSTEMS 
IN 

HIGHER  ORDER  SOFTWARE 
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1 . 0  Crisis  Relocation:  The  Need  for  a  Specification  of  "Place 


Crisis  relocation  involves  the  transfer  of  people  and  resources  from 
one  place  to  another  in  anticipation  of  either  man-made  or  natural  dis¬ 
aster.  Such  a  transfer  can  be  represented  mathematically  as  a  function 
CR  that  maps  "states  of  the  U.S."  to  "states  of  the  U.S.,"  where  a 
"state  of  the  U.S."  is  a  table  of  correspondences  between  places,  pop¬ 
ulation,  and  resources.  For  some  purposes,  only  portions  of  these  tables 
may  be  needed,  involving  correspondences  between  places  and  population, 
places  and  oil,  places  and  food,  and  so  on.  We  might  also  want  to  have 
an  allocation  function  that  tells  us  what  the  population  and  resources 
are  at  a  given  place  in  a  particular  "state  of  the  U.S."  This  mode  of 
representation  is  illustrated  in  Figure  1. 

2.0  Specification  vs.  Implementation  of  "Place" 

The  intuitive  notion  of  place  is  illustrated  in  Figure  2.  A  place,  to 
a  first  approximation,  is  a  well-defined  [geometrically)  non-empty 
region  in  two-dimensional  space.  In  Figure  2,  places  are  defined  in 
terms  of  a  grid  superimposed  on  a  map  of  the  U.S.  If  each  such  region 
is  given  a  unique  name,  then  tables  of  the  sort  illustrated  in 
Figure  1  can  be  straightforwardly  constructed.  Note  that  the  naming 
scheme  itself  is  arbitrary;  while  numbers  are  used  in  the  implementation 
of  the. notion  place  in  Figure  2,  they  are  not  assigned  in  any  particular 
order  or  pattern.  Patterns  of  various  kinds  may  be  chosen  for  one 
reason  or  another,  but  these  are  then  propoerties  of  the  specific  imple¬ 
mentations  in  which  they  occur,  rather  than  characteristics  of  the  notion 
place  itself.  . 

The  purpose  of  specifying  a  notion  like  place  independently  of  implemen¬ 
tation  is  to  characterize  what  it  is  about  all  the  implementations  of 
such  a  notion  that  make  them  implementations  of  that  notion.  Whatever 
properties  of  specific  implementations  of  place,  for  example,  are  not 
relevant  to  their  being  places,  but  only  to  their  exemplifying  a  particular 
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One  Implementation  of  the  Not 


subclass  of  places,  are  not  included  in  the  specification  of  place.  In 
the  case  of  place,  the  minimal  set  of  properties  that  seems  to  be  required 
in  the  specification  is  provided  by  the  four  cardinal  directions.  Given 
any  place  in  a  geographically  distributed  system,  we  can  always  travel 
from  that  place  to  one  that  is  north,  south,  east,  or  west  of  it.  This 
is  the  property  of  place  that  we  adopt  here  as  providing  an  abstract 
characterization  of  that  notion. 
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3.0  HOS  Specification  of  "Place":  First  Approximation 


An  initial  HOS  specification  of  data  type  PLACE  is  given  in  Figure  3. 
North,  south,  east  and  west  are  formalized  as  primitive  operations  that 
.  map  places  to  places.  The  essential  constraints  on  the  behavior  of  the 
primitive  operations  -  -  i.e.,  what  it  is  about  them  that  qualifies 
them  as  formalizations  of  the  four  cardinal  directions  -  -  are  given  in 
the  form  of  axioms,  which  are  in  this  case  eight  in  number.  The  first 
four  axioms  in  Figure  3  stipulate  that  the  members  of  each  pair  North/ 
South  and  East/West  constitute  inverse  operations;  the  last  four  axioms 
stipulate  that  the  members  of  each  pair  North/East,  North/West,  South/  . 
East,  South/West  are  orthogonal.  The  first  axiom,  for  example,  says 
that  the  place  that  is  immediately  north  of  the  place  that  is  immediately 
south  of  some  place  is  that  place  itself,  while  the  last  axiom  says  that 
we  get  to  the  same  place  from  a  given  place  whether  we  travel  first 
one  place  south  and  then  one  place  west  or  first  one  place  west  and  then 
one  place  south. 
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4.0  An  Implementation  of  "Place" 


Figure  4  illustrates  one  way  in  which  the  example  in  Figure  2  can  be 
interpreted  as  an  implementation  of  the  specification  in  Figure  3.  The 
table  in  Figure  4  assigns  to  each  of  place  in  Figure  2  immediate 
northern,  southern,  eastern,  and  western  neighbors,  thus  providing 
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»  Fig.  3 
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DATA  TYPE:  PLACE; 

PRIMITIVE  OPERATIONS: 
place^  =  North  (placej); 
place^  =  South  (placeg); 
place^  =  East  (place2); 
place^  =  West  (place2); 

AXIOMS: 

WHERE  p  IS  A  PLACE 
North  (South(p))  =  p; 

South  (North(p))  =  p; 

East  (West  (p))  =  p; 

West  (East  (p))  =  p; 

East  (North(p))  =  North  ( East ( p ) ) ; 
East  (South(p))  =  South  (East(p)); 
West  (North(p))  =  North  (West(p)); 
West  (South(p))  =  South  (West(p)); 

ENO  PLACE; 


HOS  Specification  of  Data  Type  PLACE  -  First  Approximation: 


The  Four  Cardinal  Directions 


definitions  of  the  four  primitive  operations,  as  required  by  Figure  3. 

The  specific  assignments,  furthermore,  are  constructed  in  such  a  way 
that  all  of  the  axioms  in  Figure  3  are  satisfied.  Place  23,  for 
example,  gets  place  31  as  its  immediate  northern  neighbor  and  place  31 
gets  place  23  as  its  immediate  southern  neighbor;  this  verifies  the 
first  axiom  in  Figure  3  for  the  value  p  =  place  23.  Place  23,  similarly,, 
gets  place  29  as  its  immediate  southern  neighbor  and  place  44  as  its 
immediate  eastern  neighbor,  while  place  48  is  both  the  immediate  eastern 
neighbor  of  place  29  and  the  immediate  southern  neighbor  of  place  44; 
this  verifies  the  sixth  axiom  in  Figure  3  for  the  value  p  =  place  23. 

The  other  assignments  in  Figure  4  are  also  easily  verified  as  satisfying 
Figure  3  in  the  same  way.  Note  that  the  table  in  Figure  4  provides  one 
interpretation  of  Figure  2  as  an  implementation  of  Figure  4,  but  not 
the  only  such  interpretation.  Figure  4  corresponds  to  the  most  intuitively 
straightforward  interpretation  in  which  North,  South,  East,  and  West 
are  taken  to  correspond  respectively  with  up,  down,  right,  and  left, 
but  other  correspondences  between  these  two  sets  of  directions  are  also 
possible,  depending  on  the  requirements  of  the  situation.  Note  also 
that  the  gridwork  provides  a  highly  idealized  form  of  implementation  for 
the  specification  in  Figure  3.  Irregularly  shaped  regions  can  also  be. 
used  to  implement  this  specification  as  long  as  the  four  primitive 
operations  representing  the  cardinal  directions  are  guaranteed  to  be 
always  single  valued. 


5.0  Problems  With  the  First  Appoximation;  The  Need  for  Border  Regions 

There  is  still  one  discrepancy  between  Figure  3  and  Figure  4,  however, 
as  illustrated  by  the  gaps  in  the  assignments  in  the  latter.  While 
Figure  3  accounts  adequately  for  the  directionality  of  a  geographically 
distributed  system,  it  makes  no  provision  at  all  for  border  regions,  i.e., 
regions  with  one  or  more  expected  neighbor  missing.  The  specification 
in  Figure  3,  though  adequate  for  infinitely  extended  regions  with  no 
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external  borders,  is  deficient  for  the  more  normal  case  in  which  external 
’  borders  are  included,  such  as  Figure  2. 

The  absence  of  border  regions  not  only  is  intuitively  unnatural,  but 
also  precludes  the  construction  of  useful  operations  and  structures, 
such  as  the  operation  in  Figure  5.  The  control  map  in  Figure  5  defines 
an  operation  that  tests  whether  or  not  one  place  is  north  of  another. 

OR  and  COJOIN  in  the  figure  are  HOS  control  structures:  OR  indicates 
an  alternative  determined  by  the  indicated  binary  conditions  and 
JOIN  denotes  sequence;  COJOIN  is  a  generalized  version  of  JOIN  in 
which  the  sequential  operations  share  some  variables.*  As  the  figure 
indicates,  the  operation  inputs  two  places,  p-j  and  p^,  and  outputs  a 
boolean  b,  which  is  True  if  p^  is  north  of  P2  and  False  otherwise. 

.  First  the  immediate  northern  neighbor  of  P2  is  found  and  named  p'.  This 
place  p1  is  then  tested  against  p-j ;  if  they  are  equal  b  is  True  and  the 
process  stops.  If  p *  is  not  p-j,  then  p'  is  tested  to  see  whether  or 
^  not  it  is  a  northern  border.  If  p*  is  a  northern  border,  then  b  is 

False  and  again  the  process  stops.  If  p'  is  not  a  northern  border, 
then  the  entire  process  repeats  with  p'  as  the  second  input  instead  of 
P2*  Eventually,  after  enough  repetitions,  the  process  stops  with  either 
f  True  or  False  as  the  value  of  b. 

The  problem  with  this  operation,  of  course,  is  that  we  have  thus  far 
not  given  any  meaning  to  the  operation  NBorder,  which  appears  in  the 
I  condition  of  the  lowest  OR.  We  have  interpreted  NBorder  intuitively 

as  meaning  "is  a  northern  border,"  but  we  have  not  characterized  what 
this  means  formally,  as  we  did  for  the  four  direction  operations,  for 
example. 

» 

6 . 0  HOS  Specification  of  "Place":  Second  Approximation 

I  One  way  in  which  we  might  incorporate  border  regions  is  given  in  Figure 

6.  Each  axiom  in  Figure  6  corresponds  to  one  of  the  axioms  in  Figure  3, 

*  "Techniques  For  Operating  System  Machines",  TR-7,  Higher  Order  Software,  Inc 
Cambridge,  Massachusetts,  July  1977. 
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PRIMITIVE  OPERATION: 
place2  •  North  (place,); 
p1ace2  *  South  (place,); 
place2  •  East  (place,); 
place2  •  West  (place,); 
boolean  ■  NBorder  (place); 
boolean  *  SBorder  (place); 
boolean  »  EBorder  (place); 
boolean  *  WBorder  (place); 


AXIOMS: 


WHERE  p  IS  A  PLACE; 


North  (South(p) )  «'p  or  (2ph 


East  (South(p))  *  South  (East^p))  OR  kr£J£CT  ' 

^REJECT 


West  (South(p))  *  South  (West^p))  OR  Kprirf-r  (2p); 


PARTITION  OP  p  IS 

^1  SBorder  (p)  *  False, 


Zp|  SBorder  (p)  *  True;  . 

South  (North(p) )  «  3p  OR  Kj^cx  C^P) ; 

East  (North(p) )  =  North  (East(3p))  OR  K^jr^x  (4p)» 
West  (North(p))  =  North  (West(3p))  OR  KR-JECT  (4p); 


PARTITION  OF  p  IS 

3p|  NBorder  (p)  s  False, 


4p|  NBorder  (p)  «  True; 


East  (West(p))  *  p  OR  ^p£j££x  ^  P^* 


North  (West(p))  *  West  (North(5p))  OR  Kr£J££x  (6P) 1 


South  (West(p))  «  West  (South(5p))  OR  KR£j££x  (6p); 


PARTITION  OF  p  IS 
5_ 


5p|  WBorder  (p)  *  False, 


bp|  WBorder  (p)  *  True; 


West  (East(p) )  *  7p  OR  kr£JEct  (8p); 

North  (East(p))  *  East  (North(7p))  OR  KR£j£CT  (8P) I 
South  (East(p))  *  East  (South(7p))  OR  Kj^j^x  (8p)> 


PARTITION  OF  p  IS 

5p  |  EBorder  (p)  *  False, 
®p  !  EBorder  (p)  *  True; 


END  PLACE; 


6  HOS  Specification.  Data  Type  PLACE  ~  Second 
Four  Cardinal  Directions  Plus  Border  Regions 


except  that  the  order  has  been  changed  to  group  axioms  according  to 
which  partition  they  involve.  The  partitions  are  based  on  the  four 
new  primitive  operations  that  define  the  notion  of  border:  northern 
border,  southern  border,  eastern  border,  and  western  border.  Again 
places  are  assumed  to  be  discrete,  distinguishable  entities.  The  number 
of  places  is  unspecified;  there  can  be  as  few  as  one  or  as  many  as 
desired,  depending  on  how  one  chooses  to  implement  the  data  type.  As 
in  Figure  3,  each  place  is  assumed  to  have  a  unique  immediate  northern 
neighbor,  a  unique  immediate  southern  neighbor,  a  unique  immediate 
eastern  neighbor,  and  a  unique  immediate  western  neighbor. 

A  single  place  may  be  two  or  more  kinds  of  borders  at  the  same  time, 
depending  on  the  circumstances  and  the  implementation  they  require. 

In  Figure  2,  for  example,  place  number  6  is  both  a  southern  border  and 
a  western  border,  while  place  number  4  is  a  northern  border,  an  eastern 
border,  and  a  western  border.  Place  number  12,  however,  is  both  a  southern 
border  and  a  western  border,  but  not  an  eastern  border,  since  it  has 
place  number  8  as  its  immediate  eastern  border;  a  finer  grid  or  an  im¬ 
plementation  that  admits  irregularly  shaped  places  might  make  place 
number  12  an  eastern  border  by  not  admitting  place  number  8  as  its  im¬ 
mediate  eastern  neighbor,  If  there  is  only  one  place,  it  may  may  be  a 
northern  border,  a  southern  border,  an  eastern  border  and  a  western 
border  all  at  the  same  time. 

i 

In  short  the  primitive  operation  list  contains  representations  for  four 
binary  distinctions,  corresponding  to  whether  or  not  a  given  place  is 
one  of  the  four  kinds  of  border,  and  four  directions,  which  are  pairwise 
either  inverses  or  orthogonal,  except  for  borders.  The  four  binary 
distinctions  are  used  to  define  the  partitions  and  the  four  directions 
are  characterized  in  terms  of  them  in  axioms.  The  first  group  of  axioms 
depends  on  whether  or  not  the  input  place  is  a  southern  border,  the  sec¬ 
ond  group  on  whether  or  not  it  is  a  northern  border,  the  third  on  whether 
or  not  it  is  a  western  border,  and  the  fourth  on  whether  or  not  it  is 
an  eastern  border.  The  first  axiom  in  each  group  tells  us  that  the 


direction  relevant  to  the  corresponding  partition  is  an  inverse  of  one 
other  direction  unless  the  input  is  the  corresponding  kind  of  border. 

The  other  two  axioms  in  each  group  tell  us  that  the  direction  relevant 
to  the  partition  is  orthogonal  to  the  two  directions  of  which  it  is 
not  an  inverse,  again  unless  the  input  place  is  the  appropriate  kind 
of  border  region. 

7.0  The  Orientation  Structure 

Given  a  formalization  of  the  notion  border,  such  as  the  one  in  Figure  6, 
we  not  only  can  legitimately  use  the  operation  in  Figure  5,  which  tests 
one  place  to  see  if  it  is  north  of  another,  but  also  can  generalize  it 
to  a  structure  that  tests  two  places  for  any  given  orientation.  First 
we  define  an  operation  that  tests  whether  a  place  is  a  northern,  southern, 
eastern,  or  western  border,  as  shown  in  Figure  7.  JOIN,  again,  is  an 
HOS  control  structure  involving  sequence,  and  INCLUDE  is  an  HOS  control 
structure  involving  independent  processings  a  number  of  different 
operations;  along  with  OR,  they  constitute  the  three  primitive  control 
structures  of  HOS,  in  terms  of  which  any  ether  control  structure  can  be 
^  defined.  Clone  is  a  universal  primitive  operation  that  produces  an 

indicated  number  of  copies  of  some  variable  and  its  value;  Or  is  an 
operation  on  data  type  BOOLEAN  that  produces  an  output  True &if  any  one 
of  a  number  of  boolean  inputs  is  True,  and  False,  otherwise. 

♦ 

Second  we  use  this  border-region  operation  to  define  a  partition  in  an 
orientation  structure,  as  shown  in  Figure  8.  The  structure  F-orientation 
enables  us  to  test  the  orientation  of  any  place  p-|  with  respect  to  any 
t  place  $2'  it  1S  a  generalization  of  the  IsNorth  operation  in  Figure  5, 

obtained  by  replacing  North  in  Figure  5  with  an  arbitrary  orientation 
operation  F  and  replacing  NBorder  in  Figure  5  with  the  more  general 
Border  Region  operation.  Whereas  IsNorth  in  Figure  5  is  a  specific 
»  operation,  Fq  in  Figure  6  is  a  variable  operation;  it  is  this  fact  that 

makes  what  is  defined  in  Figure  6  a  structure  rather  that  an  operation. 


I 
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OPERATION:  b  *  Border  Region  (p); 

WHERE  b,  b.,  b,.  bv  b.,  ARE  BOOLEANS; 


(b)  Control  Hap  for  Operation  Border  Region:  First  Approximation 


STRUCTURE:  b  »  F-oHentat1on(p, ,P?); 


Note  that  F  in  Figure  6  need  not  be  one  of  North,  South,  East  or  West 
in  order  for  the  structure  to  make  intuitive  sense;  any  finite  com¬ 
bination  of  these  primitive  operations  can  be  used  as  a  value  of  F. 

We  can  test  whether  p^j  is  north  of  P2»  in  other  words,  as  in  Figure  5, 
but  we  can  also  test  whether  p^  is  south  of  P2,  whether  it  is  northeast 
of  P2>  whether  it  is  southsouthwest  of  ?2«  whether  it  is  north  or 
southwest  of  .P2,  and  so  on.  All  we  have  to  do  is  replace  F  in  the  tree 
with  the  appropriate  combination  of  the  four  direction  operations  and 
the  instantiated  structure  will  then  perform  the  corresponding  test. 

8,0  Problems  With  the  Second  Approximation:  Underdetermination  of  "Border 

There  is  still  a  problem,  however,  with  the  formalization  of  the  border 
notion  included  in  Figure  6,  and  thus  also,  by  implication  with  the 
structure  in  Figure  8.  The  four  border  primitive  operations  ere  used 
in  Figure  6  to  define  the  partitions  that  determine  when  the  various 
binary  compositions  of  direction  operations  reject,  but  there  are  no 
further  constraints  on  the  border  operations  themselves.  Intuitively, 
a  border  place  is  one  which  has  no  immediate  neighbor  in  some  direction. 
While  this  characteristic  of  border  places  is  reflected  implicitly  in 
the  axioms  of  Figure  6,  these  axioms  are  weaker  in  that  they  deal  only 
with  immediate  neighbors  of  immediate  neighbors,  rather  than  with  im¬ 
mediate  neighbors  themselves.  The  value  of  North(South(p) ) ,  for  example, 
is  REJECT  if  the  value  of  SBorder  (p)  is  true,  but  we  have  no  further 
information  about  when  the  latter  is,  in  fact,  the  case.  The  border 
operations  are  underdetermined,  in  other  words,  with  insufficient  in¬ 
formation  being  given  in  the  specification  to  characterize  them  adequately 

9.0  HOS  Specification  of  "Place":  Final  Version 

This  deficiency  is  remedied  in  Figures  5,  10,  and  13,  as  illustrated 
in  Figures  11  and  12.  Figure  9  contains  our  final  HOS  specification 


DATA  TYPE:  PLACE; 

PRIMITIVE  OPERATIONS: 

?1ace2  *  North(p1ace1 ) 
place,,  *  South(p1ace1 ) 
place^  •  East  (place^) 
place^  •  West  (place^) 

AXIOMS: 

WHERE  p  IS  A  PUCE 

North  (South(p))  «  1 p  OR  KR£JECT  (2p); 

East  (South(p))  *  SouthfEast^p))  OR  Kfjrj^y  ( 2p) ; 
West  (South(p))  *  South(West(1p))  OR  ( 2 p ) ; 

PARTITION  OF  p  IS 

1 p |  Equal  (South(p),  REJECT)  *  False, 

3p|  Equal  (South(p),  REJECT)  •  True; 
$outh(North(p) )  «  3p  OR  KR£JECT  (4p) ; 

East  (North(p))  *  North(East(3p))  OR  KR£j£(.y  (4p) ; 
West  (North(p))  «  North(West{3p) )  OR  Kpc. (4p); 

PARTITION  OF  p  IS 

3p|  Equal  (North(p) ,  REJECT)  *  False, 

4p|  Equal  { North(p) ,  REJECT)  «  True; 

East  (Kest(p) )  «  5p  OR  K^^y  (6p); 

North(West(p) )  »  West(North(5p)  OR  KR£j£ry  (^p); 

South(West(p) )  *  West(South(5p)  OR  KR£JECT  (6P); 
PARTITION  OF  p  IS 

5p|  Equal  (West(p),  REJECT)  *  False, 

®p|  Equal  (West(p),  REJECT)  *  True; 

West  (East(p))  *  7p  OR  KREj££y  (8p)i 
North(East(p))  *  East(North(7p)  OR  KR£j£Ey  (8p); 
South(East(p))  *  East(South(7p)  OR  KR£j£»y  (fip) ; 

PARTITION  OF  p  IS 

7p|  Equal  (East(p),  REJECT)  =  False, 

8p|  Equal  (East(p) ,  REJECT)  -  True; 

END  PLACE; 


of  data  type  PLACE.  The  axioms  in  Figure  9  are  identical  to  those  in 
Figure  C;  the  differences  between  the  two  specifications  lie  in  their 
primitive  operation  lists  and  in  their  partitions.  Figure  9,  like 
Figure  3,  has  only  four  primitive  operations,  which  correspond  to  the 
four  cardinal  directions;  the  four  border  operations  have  been  removed 
from  both  the  primitive  operation  list  and  the  partitions,  which  are 
now  defined  directly  in  terms  of  the  non-existence  of  an  appropriate 
immediate  neighbor.  North(South(p) )  rejects,  according  to  Figure  9, 
when  South(p)  is  equal  to  REJECT,  rather  than  when  some  unspecified 
SBcrder  operation  happens  to  have  the  value  True.  Clearly,  this  is 
what  we  mean  intuitively  by  a  border  place. 

The  use  of  NBorder,  SBorder,  EBorder,  and  WBorder  as  primitive  operations 
in  the  original  partition  is  peculiar,  in  other  words,  because  what 
these  operations  are  is  not  further  specified;  these  boolean-valued 
operations  are  intimately  related  to  the  place-valued  ones,  but  this 
fact  is  not  indicated  in  the  specification  (in  Figure  6).  What  is 
really  going  on  in  data  type  PLACE  is  what  we  see  in  Figure  9;  the 
border  operations  are  not  primitive,  at  all  but  consist,  rather,  in  the 
testing  of  equality  between  immediate  neighbors  and  the  REJECT  element. 
This  recognition  enables  us  to  define  a  border  structure  that  produces 
an  appropriate  border  operation  for  each  of  the  four  cardinal  directions 
(and  combinations  thereof).  A  control  map  and  AXES  syntax  for  this 
border  structure  is  given  in  Figure  10. 

10.0  The  Border  Structure 

The  border  structure  in  Figure  10  is  a  maximally  simple  one,  consisting 
of  only  two  levels  of  decomposition  and  one  control  structure,  the  prim¬ 
itive  control  structure  OR,  which  provides  mutually  exclusive  and  col¬ 
lectively  exhaustive  alternatives.  For  a  given  direction  operation  F, 
the  structure  first  partitions  the  set  of  places  into  two  disjoint 
classes,  those  which  have  an  immediate  neighbor  in  the  direction  F 
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(F(p)  does  not  reject)  and  those  which  have  no  immediate  neighbor  in 
the  direction  F  (F(p)  rejects).  If  a  place  p  is  in  the  first  class, 
then  F-border  assigns  it  a  b  value  of  False,  indicating  that  it  is  not 
an  F  border;  if  p  is  in  the  second  class,  then  F-border  assigns  it  a 
b  value  of  True,  indicating  that  it  is  an  F  border. 

Note,  again,. that  formulating  the  border  concept  as  a  structure  auto¬ 
matically  generalizes  it  beyond  the  usual  N,  S,  E,  W  borders  we  dis¬ 
cussed  earlier.  The  function  F  in  Figure  10  can  be  any  mapping  at 
all  from  places  to  places.  The  notion  of  border  makes  the  most  in¬ 
tuitive  sense  when  F  is  some  repeated  composition  of  a  single  direction 
operation,  and  it  is  probably  most  useful  when  F  is  simply  one  of 
N,  S,  E,  arid  W;  the  structure  also  provides,  however,  for  more  abstract 
kinds  of  borders,  which  might  be  useful  in  some  applications,  for 
example,  EN  borders  -  -  i.e.,  places  which  have  no  neighbor  immediately 
north-east  of  them  -  -  or  WWSS  borders  -  -  i.e.,  places  which  have  no 
neighbor  immediately  south-south-west-west  of  them.  Note  that  the 
orthographic  order  of  function  names  is  the  reverse  of  that  of  func¬ 
tional  application.  We  will  henceforth  use  a  terminology  that  reflects 
the  former  order  to  avoid  confusion  in  referring  to  borders.  Some  of 
the  possibilities  that  become  available  are  illustrated  in  Figure  11. 

The  examples  in  Figure  11  deserve  careful  study.  Note  that  whether  or 
not  a  place  is  a  boundary  place  of  one  sort  of  another  is  determined 
not  by  the  grid,  which  is  included  only  for  intuitive  pictorial-  clarity 
but  by  the  explicit  implementation,  in  this  case  given  by  Figure  4. 

Place  number  46  in  Figure  2,  for  example,  looks  superficially  as  if  it 
is  not  a  west-south-south  border,  because  place  53  seems  to  be  its  im¬ 
mediate  west-south-south  neighbor.  If  we  check  the  table  in  Figure  4, 
however,  we  realize  that  this  is  not  the  case,  because  place  number  2, 
the  immediate  southern  neighbor  of  place  number  46,  itself  has  no  im¬ 
mediate  southern  neighbor.  Looking  again  at  Figure  2,  we  confirm  that 
this  is  indeed  the  case  in  the  picture  as  well.  Place  number  46,  in 
other  words,  is  a  west-south-south  border  because  South(South(number  46)) 
rejects  and  so  West(South(South(number  46)))  rejects  as  well.  Note 
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Fig.  lid  The  West- South-South  Borders  of  Figure  2:  Places  With  No  Immediate  West- South-Southern  Neighbor 


also,  again  using  place  number  46  as  an  example,  that  a  West-South-South 
border  is  not  necessarily  a  South-South-West  border.  In  this  case, 
West(South(South(number  46)))  has  value  REJECT  as  we  have  seen,  but 
South(South(West(number  46)))  has  place  number  53  as  its  value. 

The  intuitive  character  of  the  border  notion  can  be  enhanced  by  using 
implementations  of  Figure  9  based  on  finer  grids  that  that  of  Figure  2. 
In  Figure  lid,  for  example,  the  eastern  coast  of  Georgia  and  Maine  end 
up  as  West-South-South  borders,  but  this  does  not  happen  in  Figure  12, 
which  uses  a  finer  grid.  Conversely,  in  Figure  lid,  most  of  the  land¬ 
locked  state  of  Utah  and  all  of  Tennessee  are  counted  as  West-South- 
South  borders  but  this  does  not  happen  in  Figure  12.  Note,  again,  that 
the  sections  of  a  grid  do  not  have  to  be  of  uniform  size,  or  even  of 
the  same  shape,  as  long  as  they  satisfy  the  specification  in  Figure  9. 
All  that  matters  in  the  choice  of  an  implementation  are  the  requirements 
of  the  problem  and  the  tastes  of  the  user. 

11.0  The  Border  Region  Operation 


Now  that  we  have  fully  specified  the  border  notion  and  adjusted  our 
specification  of  places  accordingly,  we  can  remedy  the  deficiency  that 
we  observed  in  connection  with  Figure  8.  The  problem  with  Figure  8 
was  that  the  operation  Border  Region,  used  in  the  condition  of  the 
lowest  OR  control  structure  was  defined  in  Figure  7  in  terms  of 
SBorder,  NBorder,  WBorder,  and  EBorder,  which  were  themselves  inad¬ 
equately  characterized  in  Figure  6  as  primitive  operations.  Having 
corrected  the  latter  defect,  however,  by  providing  the  general  border 
structure  in  Figure  10,  we  can  now  use  that  structure  to  construct  an 
adequate  definition  of  Border  Region. 

Our  new  characterization  of  Border  Region  is  given  in  Figure  13. 

Figure  13  differs  from  Figure  7  primarily  in  the  way  we  have  just  dis¬ 
cussed;  rather  than  the  symbols  "SBorder",  "NBorder",  "WBorder",  and 


"EBorder",  we  use  the  syntax  of  Figure  10  for  four  of  the  operations  that 
structure  defines:  "p  is  a  South  border",  "p  is  a  North,  border", 

"p  is  a  West  border",  and  "p  is  an  East  border".  We  have  also  simplified 
the  operation  somewhat,  by  using  the  non-primitive  HOS  control  structure 
COINCLUDE,  rather  than  the  primitive  control  structure  INCLUDE  plus  the 
universal  Clone  operation.  This  also  enables  us  to  eliminate  one  of 
the  JOIN  control  structures  that  we  needed  in  Figure  7, 


12.0  The  Coordinates  Operation 

Now  we  are  in  a  position  to  construct  what  is,  perhaps,  the  most  funda¬ 
mental  and  important  operation  on  data  type  PLACE,  other  than  those 
used  in  specifying  the  data  type  itself.  Given  two  places,  it  is  often 
essential  to  know  the  relative  location  of  one  of  them  with  respect  to 
the  other.  Clearly,  if  we  are  given  a  pictorial  implementation  of  the 
data  type,  with  two  places  indicated,  the  problem  is  a  trivial  one,  as 
illustrated  in  Figure  14.  All  we  have  to  do  is  count  up  or  down  and 
right  or  left  from  one  place  to  the  other  and  we  determine  where  they 
are  with  respect  to  one  another.  In  Figure  14,  we  determine  immediately 
that  place  number  28  is  two  places  south  and  six  places  east  of  place 
number  39  just  by  counting  down  and  to  the  right.  The  problem  is  not 
so  simple,  however,  if  we  are  given  our  implementation  in  the  form  of 
a  table,  such  as  that  in  Figure  4,  since  looking  at  the  entries  for 
places  like  numbers  28  and  39  gives  no  indication  at  all  as  to  what 
their  relative  locations  might  be  in  a  pictorial  grid.  In  terms  of  the 
specification  in  Figure  9,  furthermore,  the  problem  becomes  still 
more  complex,  because  no  specific  places  such  as  39  and  28  are  even 
identified.  Since  a  specification  gives  only  the  general  properties 
of  the  members  of  a  data  type,  what  we  really  need  in  connection  with 
our  specification  of  data  type  PLACE  is  a  definition  of  what  we  mean 
in  general  by  the  relative  locations  of  two  places.  Given  a  particular 
implementation  of  the  data  type,  this  definition  should  then  provide  an 
intuitively  natural  notion  of  relative  place  for  the  places  provided  by 
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Fig.  14  Given  A  Pictorial  Implementation,  The  Coordinate  Problem  is  Trivial 


t 
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that  implementation.  Such  a  definition  is  provided  by  the  operation 
Coordinates  that  we  will  construct  here. 

The  basic  idea  behind  the  operation  is  illustrated  in  Figure  15,  which 
uses  the  grid  of  Figure  12  as  a  sample  implementation.  In  contrast  to 
the  case  of  Figure  14,  in  which  the  relative  orientations  of  the  re¬ 
spective  places  are  known  and  only  the  coordinates  are  lacking,  the 
general  situation  on  the  specification  level  lacks  even  the  information 
about  orientation.  If  we  choose  two  places  at  random,  we  do  not 
even  know  in  what  direction  either  lies  in  with  respect  to  the  other, 
if  a  pictorial  representation  is  not  provided.  This  deficiency  can  be 
overcome  by  generating  search  rays  in  all  four  cardinal  directions  from 
each  of  the  two  places,  as  illustrated  in  Figure  15.  Eventually,  one 
of  the  rays  from  each  place  will  intersect  one  of  the  rays  from  the  other 
and  the  coordinate  count  can  be  made  from  the  point  of  intersection. 
Actually,  two  such  intersection  points  will  always  be  generated,  but  the 
same  coordinates  will  result  by  counting  from  either  one. 

The  control  map  for  the  coordinates .operation  is  given  and  clarified 
in  Figures  16  -  29.  Figure  16  gives  the  top-level  architecture  of  the 

,  operation,  which  consists  of  Initialize,  Test,  and  Finalize  modules.  The 

Initialize  module  serves  only  to  provide  initial  values  for  all  of  the 
relevant  variables  and  requires  no  further  explication.  Its  complete 
decomposition  is  given  in  full  in  Figure  17.  Note  that  variables  in 

*  the  control  map  that  are  of  the  form  x  are  lists,  as  explained  in  Figure  18. 
The  test  module  is  the  meat  of  the  operation,  since  it  is  this  module  that 
generates  the  search  rays  and  determines  when  an  intersection  has 
occurred.  The  upper-level  decomposition  of  this  module  is  given  in 

•  Figure  19.  It  is  the  Finalize  module  that  performs  the  coordinate 
count  and  assigns  values  to  the  coordinate  variables.  Its  top-level 
decomposition  is  given  in  Figure  20. 


♦  The  search  rays  are  represented  by  the  members  of  the  osets  variable, 

which  is  generated  initially  by  the  Initialize  Sets  submodule  of  the 
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tecture  of  Coordinate 


M\)  »  UUUMi»(p| 


Fig.  19  Tost  Module  of  Coordinate  Operation 


Initialize  module  and  expanded  later  by  the  Expand  Sets  submodule  of  the 
Test  module.  Expand  Sets,  shown  in  Figure  21,  takes  the  sets  of  places 
in  each  direction  from  a  given  place  and  adds  the  next  place  in  each 
direction  to  the  respective  set,  using  the  Expansion  Structure  given  in 
Figure  22.  An  HOS  specification  of  data  type  FINITE  SET  is  given  in 
Figure  23,  with  the  Unit  Set  operation  of  Figure  17  given  in  Figure  24. 

Note  that,  according  to  this  specification,  a  FINITE  SET  can  be  implemented 
as  any  finite  set-like  object:  stacks,  queues,  files,  and  so  on,  given 
that  a  cardinality  operation  is  defined  on  them.  Building  a  FINITE  SET 
(OF  T)  for  some  type  T  is  like  marking  the  members  of  T  with  a  label. 

This  is,  in  effect,  the  way  finite  sets  are  used  in  the  coordinates  op¬ 
eration. 

The  Test  Intersection  submodule,  shown  in  Figure  25,  tests  to  see  whether 
an  intersection  has  occured  between  any  of  the  generated  search  rays. 

If  not,  then  Expand  Sets  expands  each  ray  by  one  place  and  calls  Test 
again  to  repeat  the  whole  procedure.  If  an  intersection  has  occured, 
then  Test  is  completed  and  control  is  passed  to  Finalize  (Figure  20) 
for  the  actual  determination  of  coordinate  values. 

Finalize  begins  with  a  recall  of  Test  Intersection,  solely  in  order  to 
regenerate  the  correct  obooleans  values  needed  in  Assign  Coordinates 
and  then  passes  control  directly  to  the  latter  submodule  given  in 
Figure  26.  It  is  Assign  Coordinates  that  generates  the  values  for  the 
output  variables  of  the  overall  Coordinates  function.  Note  that  only 
one  of  the  alternatives  contained  in  Assign  Coordinates  gets  used  in 
any  single  performance  pass,  the  choice  being  determined  by  which  search 
rays  happen  to  intersect  on  that  pass.  Each  Assign  operation  of 
Assign  Coordinates  differs  slightly  from  the  others,  as  shown  in  Figure 
27,  but  all  make  use  of  the  Count  structure  given  in  Figure  28,  Once 
the  intersection  point  has  been  found  (Test,  Figure  19),  it  is  Count 
that  counts  back  from  that  point  to  one  of  the  input  places  to  determine 
values  for  the  coordinate  variables  that  represent  their  relative  loca- 


DATA  TYPE:  FINITE  SET  (OF  T); 

PRIMITIVE  OPERATIONS: 

finite  set2  =  Insert(t,  finite  set-j); 
finite  set2  =  Extract(t,  finite  set^); 
natural  =  Card(finite  set); 
boolean  =  Isln(t, finite  set); 

AXIOMS: 

WHERE  Empty  IS  A  CONSTANT  FINITE  SET  ; 

WHERE  t  IS  A  T; 

WHERE  fs  IS  A  FINITE  SET  ; 

I s In ( t , Empty)  »  False; 

Equal (Extract(t.fs) ,  REJECT)  =  Equal (Isln(t,fs),  False); 

£xtract(t,  Insert(t.fs))  *  fs 

Insert  (t,  Extract  (t,fs))  =  ]fs  OR  KREJECT  t2fs).; 

Card  (Empty)  =  Zero; 

Card(Insert(t,fs) )  *  Succ(Card(fs) ) ; 
Succ(Card(Extract(t,fs) ) )  =  Card(]fs)  OR  KREJECT  (2fs); 

PARTITION  OF  fs  IS 

1 fs |  Extract(t.fs)  f  REJECT 
2fs |  ■  Extract(t,fs)  =  REJECT 


END  FINITE  SET; 


fs  =  Unit  Set(t) 


Fig.  24  The  Unit  Set  Operation  Used  In  Figure  17 
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Fig.  25  Test  Intersection  Submodule 
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WHERE  p.p’.cp.cp’  ARE  PLACES; 

WHERE  c,  count,  count'  ARE  NATURALS; 

WHERE  F  IS  AN  ORIENTATION  OPERATION; 

(any  finite  combination  of  North,  East,  South,  West) 


The  way  the  Assign  operations  work  is  further  elaborated  in  Figures  29 
and  30.  Figure  29  contains  all  possible  ways  in  which  the  search  rays 
generated  from  two  input  places  can  intersect.  For  example,  nlw2 
represents  the  case  in  which  the  ray  generated  north  of  p-j  intersects 
the  ray  generated  west  of  p£»  while  e2sl  represents  the  case  in  which 
the  ray  generated  east  of  p£  intersects  the  ray  generated  south  of  p-j . 
Figure  30  gives,  in  effect,  the  coordinate  values  in  each  case,  of  which 
two  are  always  zero,  one  is  simply  the  size  of  the  intersecting  search 
ray,  and  the  last  is  obtained  from  Count.  Note  that  the  diagram  in 
Figure  26  could  be  simplified  somewhat  via  symmetry  considerations, 
since  there  are  two  coordinate-equivalent  intersection  points  for  any 
two  input  places.  Since  xnym  represents  the  same  relative-location 
configuration  as  ymxn  in  Figure  29,  it  also  yields  the  same  coordinates 
when  the  evaluations  in  Figure  30  are  carried  out. 
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nle2  0  Count  West  until  p0  Card(nlset) 
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Fig.  30  The  Coordinate  Values  in  Each  Case  of  Intersection 
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SECTION  IV 

AN  INTEGRATED  DESIGN  FOR  INDUSTRIAL 
RELOCATION  AND  RECEPTION/CARE  PLANNING  SYSTEMS 


♦ 


» 


I 


♦ 
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"Industrial  Relocation  Planning"  and  "Reception  and  Care  Planning"  are  two  large 
subsystems  of  civil  defense.  In  "On  Industrial  Relocation"  a  design  of  an 
industrial  relocation  system  was  presented.  This  effort  examines  "Reception  and 
Care  Planning"  using  the  HOS  methodology,  and,  then,  provides  a  new  design 
for  the  system  of  Reception  and  Care  Planning.  Furthermore,  using  HOS, 
Industrial  Relocation  Planning  and  Reception  and  Care  Planning  are 
integrated  into  a  unified  subsystem.  This  is  the  first  attempt  at  an 
integrated  design  of  any  subsystems  of  civil  defense. 

"On  Industrial  Relocation"  provided  an  explicit  design  via  an  HOS  control 
map  of  a  relocation  system  that  satisfied  various  requirements.  From  this 
design  an  induced  set  of  requirements  were  obtained  which  certainly  aids 
civil  defense  planners.  To  review  briefly,  the  original  list  of  require¬ 
ments  were: 


1.  to  save  the  labor  force  of  key  organizations, 

2.  to  develop  a  host  area  plan(HAP), 

3.  to' develop  a  risk  area  plan  (RAP), 

4.  to  provide  various  support, 

5.  to  schedule  movement. 


The  control  map  allowed  us  to  extend  this  list  to: 


6.  that  the  host  area  plan  and  the  risk  area  plan  cannot  be 
developed  concurrently,  in  fact,  the  host  area  plan  must  be 
developed  before  the  risk  area  plan, 

7.  providing  support  is  part  of  the  risk  area  planning  as  well  as 
the  host  area  planning,  i.e.,  submodule  of  the  modules  risk  and 
host  area  planning, 

8.  scheduling  movement  is  a  submodule  of  risk  area  planning, 

9.  scheduling  must  be  dependent  on  other  organizations  and  also 
should  take  into  consideration  spontaneous  or  undirected 
evacuation  of  part  of  the  population  at  large. 


Moreover,  in  constructing  the  control  map  some  of  the  problems  of  the 
system  became  apparent.  These  are: 
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1.  lack  of  explicitness  in  describing  what  the  functions  of  the 
system  are, 

2.  lack  of  explicitness  in  describing  the  inputs  and  outputs  of 
the  various  functions, 

3.  abundance  of  pseudomodules, 

4.  lack  of  interorganizational  planning. 

The  ability  to  isolate  precise  problems  is  vital  to  civil  defense  planners. 
Details  of  this  system  can  be  found  in  "On  Industrial  Relocation." 


The  design  of  the  reception/care  plan  is  based  on  the  System"  found  in 
Reception  and  Care  Planning  Guidance  For  Host  Communities,  especially 
"Volume  II:  Planning  Steps  and  Instructions."  The  basic  idea  of  this 
plan  can  be  summed  up  in  the  7  steps  [1]. 


1.  The  description  and  listing  of  individual  host  area  buildings 
which  can  be  used  as  congregate  lodging  facilities  by  evacuees  - 
including  the  congregate  lodging  capacity  of  each  structure. 

2.  The  designation  of  fallout  shelter  and  feeding  facilities  which 
can  be  used  by  evacuees  lodged  in  each  building  in  1  above. 

3.  The  distribution  of  the  maximum  number  of  evacuees  across  the 
above  designated  lodging,  shelter,  and  feeding  facilities. 

4.  The  designation  of  special  care  facilities  which  will  be  used 
by  special  groups  of  evacuees  posing  special  needs  or  problems. 

5.  The  division  of  the  host  jurisdiction  into  R/C  districts  and 
component  Lodging  Sections,  whose  headquarters  will  supervise 

a  manageable  number  of  evacuees  and  the  provision  of  essential, 
services  within  each  area. 

6.  The  development  of  a  staffing  plan  and  management  structure  for 
the  R/C  service  and  its  component  units. 

7.  Before- and  during  an  emerging  crisis,  recruitment,  orientation, 
and  training  for  any  unfilled  staff  positions  in  the  host  area's 
R/C  organization. 


To  be  more  specific  the  following  functions  together  with  bookkeeping 
functions  are  used: 
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Select  Participants  in  Host  County  Planning. 

Define  the  boundaries  of  the  risk  area. 

Define  the  boundaries  of  the  host  area. 

Determine  the  size  of  the  total  risk  area  (evacuee)  population. 

Describe  the  evacuee  population. 

Allocate  the  evacuee  population. 

Describe  host  county  facilities. 

Coordinate  shelter  plans  for  evacuees  and  local  residents. 

Rank-Order  the  facilities  available  to  lodge,  shelter,  and  feed 
evacuees. 

Allocate  evacuees  to  congregate  lodging,  shelter  and  feeding  facilities. 

Divide  the  county  into  R/C  divisions,  districts,  and  lodging  sections. 

Enumerate  R/C  jurisdictions  and  select  headquarters,  facilities, 
reception  centers,  and  rest  areas. 

Develop  general  tables  of  organizations  and  job  descriptions  for  all 
management  positions  in  R/C  service. 

Describe  the  organizational  structure  of  each  area  R/C  unit. 

Develop  an  operational  checklist  of  R/C  responsibilities  and  actions 
before  and  during  a  crisis. 

Complete  main  plan. 

Continue  development  of  the  county  R/C  plan  and  standby  organization. 

It  should  be  noted  that  these  functions  correspond  closely  to  the  steps  • 
found  in  volume  II  of  [1], 

These. R/C  functions  are  not  presented  in  a  separate  control  map  but  are 
intergrated  in  the  existing  control  map  for  "Plan  to  relocate  industrial 
labor  force."  The  resulting  design  is  a  unified  subsystem  of  civil  defense. 

The  relationship  between  the  system  "Industrial  Relocation  Planning"  and 
"Reception  and  Care  Planning"  is  a  complex  one.  This  is  true  in  the 
sense  that  one  system  is  not  just  a  subsystem  of  the  other,  but  that 
"Reception/Care  Planning  ”  represents  a  further  decomposition  of  "Industrial' 
Relocation  Planning"  on  many  levels.  To  make  the  relationship  between 
certain  functions  of  "Industrial  Relocation  Planning"  and  "R/C  Planning" 
clear,  we  provide  the  following: 


Desk-top  initial  allocation: 


Select  participants  in  host  area  planning. 

Precisely  define  the  boundaries  of  the  risk  area. 

Precisely  define  the  boundaries  of  the  host  area. 

Describe  the  evacuee  population  to  be  hosted  in  the  area. 

Divide  the  area  into  R/C  divisions. 

On-site  analysis  of  risk  area: 

Determine  the  size  of  the  total  risk  area  (evacuee  population) 
Describe  the  evacuee  population  in  detail. 

On-site  analysis  of  host  area: 

Rank-order  the  facilities  available  to  lodge,  shelter,  and  feed 
evacuees 

Enumerate  R/C  jurisdictions. 

Divide  the  area  into  R/C  divisions. 

Describe  host  county  facilities. 

Plan  for  reception  and  care  organization: 

Coordinate  shelter  plans  for  evacuees  and  local  residents. 

Develop  general  tables  of  organizations  and  job  descriptions  for 
all  management  positions  inthe  area  R/C  service. 

Describe  the  organizational  structure  of  each  area's  R/C  unit. 

Develop  an  operational  checklist  of  R/C  responsibilities  and 
actions  before  and  during  a  crisis. 

Complete  Main  Plan. 

Continue  development  of  the  area  R/C  plan  and  standby 
organization. 

The  above  should  be  interpreted  to  mean  that,  say,  "Determine  the  size  of 
the  total  risk  area  (evacuee)  population"  and  "Describe  the  evacuee 
population  in  detail"  will  be  in  the  decomposition  of  "On-site  analysis  of 
risk  area."  The  other  functions  are  interpreted  in  the  same  way.  The 
result  is,  of  course,  a  more  detailed  design  of  the  system. 
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To  understand  the  new  design  more  clearly,  we  nuw  provide  a  detailed 
explanation  of  those  nodes  that  have  been  modified,  i.e.,  that  have  been 
♦  further  decomposed.  The  first  is  "Desk-top  initial  allocation."  Origi¬ 

nally,  it  was  not  decomposed  further  but  we  fully  expected  that  it  should 
be.  (That  is,  it  is  a  pseudomodule.  Discussion  concerning  these  will  be 
provided  below.)  The  inputs  to  the  function  are  "company  information", 
f  "CRP",  census  data"  and  "risk  area  information".  The  outputs  are  "analyzed 

number  of  people  (to.be  evacuated)",  "participants  (in  host  area  planning)," 
"division  of  risk  area,"  and  "boundaries  of  risk  area."  In  order  to 
compute  "Desk- top  initial  allocation,"  the  functions  "Define  boundaries 
of  risk  area,"  Determine  divisions  of  risk  area,"  "Select  participants  in 
host-area  planning,"  and  "Determine  number  abd  description  of  people  to 
be  evacuated"  must  be  "computed."  The  first  two  of  these  will  produce 
"boundaries  of  risk  area"  and  "divisions  of  risk  area,"  respectively.  In 
.  order  to  "Select  participants  in  host  area  planning,"  the  functions 
"Select  area  R/C  Coordinator,"  "Select  director  of  shelter  planning  and 
allocation,"  and  "Select  deputy  coordinator  for  welfare  shelter  operation" 
must  be  executed.  These  will  provide  the  necessary  participants  in  host  area 
planning.  "Determine  number  and  description  of  peoole  to  be  evacuated" 
produces  the  obvious  output  with  "Description  of  people  to  be  evacuated" 
meaning  certain  occupational  information,  addresses,  etc.  of  the  potential 
evacuees . 

As  mentioned  above,  the  function  "On-Site  analysis  of  risk  area"  is 
decomposed  into  the  two  functions  "Determine  the  size  of  the  total  risk, 
area"  and  "Describe  the  evacuee  population  in  detail."  These  two  functions 
provide  a  more  detailed  analysis  of  the  evacuee  population  that  had  been 
established  in  "Desk-top  initial  allocation."  "Determine  the  size  of 
total  risk  area"  provides  a  better  estimate  of  the  number  of  people  to  be 
evacuated  while  "Describe  the  evacuee  population  in  detail"  will  provide 
descriptive  information  concerning  the  evacuess  and  will  also  note  any 
special  problems,  e.g.,  large  population  of  elderly. 

"On-Site  analysis  of  host  area"  is  revised  in  that  the  outputs  are 

"hosting  capabilities"  (as  in  the  earlier  control  map),  "host  area  divisions," 

"enumeration  of  R/C  jurisdictions,"  and  "ordered  facilities."  These  are  obtained 
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by  "Determine  hosting  capabilities,"  "Divide  host  area  into  R/C  divisions," 
"Enumerate  R/C  jurisdictions,"  and  "Rank-Order  facilities  available," 
respectively.  Note  that  "Rank-Order  facilities  available"  must  precede 
"Enumerate  R/C  jurisdictions  and  select  facilities"  which  precedes  "Divide 
the  host  area  into  R/C  divisions."  The  reason  for  these  precedence  relations 
is  that  the  output  of  "Rank-Order  facilities"  is  input  to  "Enumerate 
R/C  jurisdictions  and  select  facilities."  The  output  of  this  function  is 
then  input  to  "divide  the  host  area  into  R/C  divisions". 


The  node  "Plan  for  reception  and  care  organization"  is  found  in  both 
"Industrial  Relocation"  design  and  the  integrated  design.  In  "Industrial 
Relocation"  the  decomposition  obtained  basically  the  functions  "Review" 

(the  set  of  requirement  statements),  "Compare"  (sources  available  and  set 
of  requirement  statements),  and  "Argument  existing  capabilities"  (which 
produced  "HAP"  as  output).  [1]  provides  the  basis  for  several  functions 
that  enabled  a  further  decomposition  of  "Plan  for  R/C  organization." 

These  functions  are  "Coordinate  shelter  plan  for  evacuees  and  local 
residents,"  "Develop  general  tables  of  organization  and  job  descriptions 
for  all  management  positions  in  the  area  R/C  service,"  "Describe  the 
organizational  structure  of  each  area  R/C  unit,"  "Develop  an  operational 
checklist  of  R/C  responsibilities  and  actions  before  and  during  a  crisis-," 
"Complete  main  plan,"  and  "Continue  development  of  the  are  R/C  plan." 

As  noted  above,  these  functions  are  in  the  decomposition  of  "Plan  for 
reception  and  care  organization."  This  should  seem  natural  since, 
intuitively,  these  functions  are  generally  high-level'  organizational  planning 
activities.  In  fact,  the  last  two  functions  are  the  actual  development 
of  the  main  plan  and  the  continuing  development  of  such  a  plan,  both  of 
which  would  not  occur  in  a  lower  level  of  civil-defense  planning. 

An  .important  point  to  make  is  that  "Continue  development  of  plan"  rather 
than ' "Complete  main  plan"  outputs  HAP.  The  "main  plan"  (the  output  of 
"Complete  main  plan")  provides  the  basic  information  and  general  statements 
of  R/C  purposes  and  orgainzation.  It  not  only  acquaints  those  who  are 
interested  in  R/C  planning,  but  it  also  provides  the  activities  (functions) 
for  those  who  are  crucially  involved. 


57 


HAP,  however,  cannot  remain  static.  It  continually  needs  to  be  improved 
or  updated  due  to  population  shifts,  relocating  industries,  changing  R/C 
staff,  among  other  factors.  So  in  this  respect  the  control  map  accurately 
reflects  this.  HAP  is  not  the  output  of  "Complete  main  plan,"  otherwise, 
it  would  remain  fixed.  "HAP"  is  the  output,  though,  of  "Continue 
development  of  plan,"  which  indicates  a  plan  that  is  up-to-date  and  dynamic. 

As  noted  above  and  in  "On  Industrial  Relocation,"  Indust-ial  Relocation 
contained  many  pseudomodules.  (A  pseudomodule  is  a  module  that  is  not 
fully  decomposed,  but  is  expected  to  be  so  later,)  "Desk-top  initial 
allocation"  is  one  such  example.  In  the  original  control  map,  this 
particular  node  had  the  form: 

"analyzed  number  of  people  _  Desk-top  initial  (co.  info,  CRP,  c.d., 
to  be  evacuated"  risk  area  info.)  allocation 

The  integrated  design  shows  that  this  particular  node  now  becomes: 

FigOre  1. 

Mote  that  the  level  of  decomposition  and,  therefore,  the  level  of  detail 
is  greater  in  the  integrated  design  than  in  the  original  control  map. 

In  addition  to  "Desk-top  initial  allocation,"  "On-site  analysis  of  host 
area,"  "On-site  analysis  of  risk  area,"  and  "Plan  for  reception  and  care 
organization"  have  been  more  fully  decomposed.  Therefore,  the  design  of 
the  system  is  more  complete.  Clearly,  this  aids  the  planners  and  allows 
for  a  more  easily  implementable  system.  (See  Figures  2  and  3). 

One  observation -that  should  be  emphasized  is  that  only  minor  modifications 
were  needed  in  the  integration  of  R/C  planning  with  Industrial  Relocation 
Planning,  The  inputs  and  outputs  to  both  the  Industrial  Relocation  System 
and  to  the  integrated  system  are  the  same.  The  inputs  ere  co,  info,  OAF, 

CRP,  census  d$ta,  set  of  requirement  statements,  r.a.  info.,  and  add.  info. 
The  output  is  composed  of  number  and  determination  of  people  to  be  evacuated, 
RAP,  and  HAP.  As  is  clear  from  the  control  maps,  the  two  systems  have  many 
of  the  same  functions  in  common. 
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To  look  at  one  example  in  detail,  consider  "Plan  for  reception  and  care 
organization."  This  function  has  the  inputs  co.  info.,  CRD,  c.d.,  set  of 
reg!s,  r.a.  info  .,  add,  info.,  better  estimate,  spec,  problems, 

(suitable)  hosting  location,  host  area  survey,  and  hosting  capabilities. 

The  output  is  host  area  plan.  Intuitively,  it  was  this  function  that  is 
related  to  various  R/C  organizational  functions.  Any  steps  found  in  [1] 
that  deal  with  the  organizational  structure  should  be  found  in  the 
decomposition  of  this  function.  And,  indeed,  this  is  the  case.  Steps  11-16 
of  [1]  are  in  the  decomposition  of  "Plan  for  R/C  organization"  (as  well 
as  other  functions  in  the  original  decomposition. 

This  observation  together  with  the  understanding  of  the  design  effort 
itself  provides  evidence  for  a  claim  made  in  "On  Industrial  Relocation". 
There  it  was  stated,  "Another  important  point  is  that  HOS  methodology  is 
universal.  In  other  words,  any  subsystem  of  civil  defense  can  be 
specified  using  control  maps.  Thus,  the  methodology  facilitates  the  ease 
by  which  various  civil  defense  systems  can  be  specified  and  verified.  It 
would  be  cumbersome  to  have  several  methodologies  each  defining  some  (but 
not  all)  of  the  subsystems.  This  would  require  a  knowledge  of  several 
methodologies  (as  compared  to  one)  in  order  to  work  within  civil  defense- 
systems  "  [2].  In  constructing  this  control  map,  only  minor 
modifications  .had  to  be  made  to  the  original  map.  Nevertheless,  it  is  via 
HOS  control  maps  that  an  integrated  system  of  civil  defense  can  be  designed. 

In  connection  with  this  sytem  of  Industrial  Relocatioh/Reception  and  Care 
Planning  system,  there  are  several  areas  that  still  have  to  be  addressed. 
These  are  the  transportation  system,  communication  system,  and  the  system 
specifying  the  distribution  of  the  relocated  population.  The  transportation 
system  would  involve  the  transportation  of  the  maximum  number  of  people  in 
the  least  amount  of  time.  In  [1],  this  is  stated  in  Step  2.3.  The 
means  of  transportation  as  well  as  the  routes  must  be  explicitly  specified 
in  the  planning  stage  to  guarantee  a  reliable  system,  if  ever  needed. 
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The  transportation  system  for  Industrial  Relocation  can  also  be  integrated 
within  the  existing  design.  It  would  be  part  of  the  decomposition  of 
"Provide  Transportation. "  This  function  is  part  of  the  risk  area  plan. 

For  more  on  the  requirements  and  problems  of  a  transportation  system, 
see  [3]. 

The  communication  system  provides  another  problem.  There  most  be  some 
way  of  providing  communication  between  the  host  area  and  risk  area 
during  and  after  evacuation.  While  evacuation  is  being  carried  out,  it 
is  important  that  information  concerning,  say,  transportation  (bottlenecks, 
etc.)  be  available  to  staging  areas  in  the  risk  area  so  other  alternatives 
could  be  considered.  Even  after  relocation,  communication  between  the 
risk  area  and  host  area  must  remain  open  so  that  those  whose  jobs  keep 
them  in  the  risk  area  or  those  commuting  between  the  two  will  be  informed 
as  to  the  latest  developements. 

One  requirement  of  a  system  of  communication  is  that  it  must  be  modular. 

This  would  imply  that  if  a  section  of  the  communication  network  is 
rendered  inoperative,  information  could  still  flow  around  the  downed  part  of 
the  system.  The  value  of  this  is  obvious. 

Also  under  the  Transportation  node  is  the  problem  of  the  distribution 
of  the  population.  This  is  an  enormous  problem  in  view  of  such  large, 
highly  populated  cities  as  New  York,  Boston,  and  Washington,  D.C.  The 
system  must  be  set  up  such  that  the  people  of  a  risk  area  are  evacuated, 
to  a  host  area  in  a  way  that  everyone  has  a  host  area  assigned,  but  that  no 
host  area  is  overcrowded.  An  overcrowded  area  would  be  one  whose  facilities 
and  services  could  not  meet  the  demands  of  all  the  people. 

This  type  of  problem  cannot  be  done  just  on  a  local  level,  n  large  system 
must  be  designed  so  that  planning  from  various  risk  areas  co  not  conflict. 
For  instance,  area  H  may  accomodate  the  people  from  either  a-ea  ?1  or  R?,  but 
not  both.  The  idea  of  transporting  the  people  from  or  R£  may  seem 
feasible  to  planners  of  Rj  and  Rg,  respectively,  but  there  must  be  some 
mechanism  preventing  both  from  formulating  this  plan.  Otherwise,  it  could 
not  support  people  from  both  R^  and  Rg,  a  potentially  tragic  situation. 

Other  problems  (food  availability,  housing,  etc.)  must  also  be  considered. 
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SECTION  V 


A  MODEL  OF  COMMUNICATION 


A  MODEL  OF  COMMUNI CAT I ON 


It  is  clear,  by  now,  that  a  model  for  communication  can  be  built  only  within  the 
framework  of  language  use.  To  ensure  a  good  "communi cation,"  [Grice]  proposes 
four  "maxims"  that  he  groups  under  the  Cooperative  Principle. 

(1)  Maxim  of  Quantity:  Make  the  contribution  to  conminication  as  infor¬ 
mative  as  is  required  for  the  current  purpose  of  the  exchange. 

(2)  Maxim  of  Quality:  Make  the  contribution  one  that  is  true,  in  that 
the  contribution  should  coincide,  as  far  as  possible,  with  the  reality 
of  the  facts.  In  some  cases,  the  exact  state  of  the  facts  are  not 
known,  and  it  is  then  necessary  to  make  approximations,  based  on 
observations,  expectations,  hopes,  etc. 

(3)  Maxim  of  Relation:  The  content  of  the  communication  should  be  rele¬ 
vant  to  the  goal  of  communication. 

(4)  Maxim  of  Manner:  The  participants  engaged  in  the  process  of  communi¬ 
cation  should  avoid,  as  much  as  possible,  ambiguity. 

I  call  these  principles  external,  because  they  monitor  every  good  or  correct 
communicative  action.  I  will  call  internal  principles  of  communication  those 
principles  referring  to  (a)  the  individuals  performing  the  communication,  which 
as  a  speech  act  has  a  certain  illocutionary  force  and  a  prelocutionary  effect; 
and  (b)  the  place  and  time  of  communication. 

The  first  internal  principle  of  communication  refers  to  the  relation  which  is 
established  within  the  context  of  communication.  Therefore,  for  example,  we 
can  talk  about  the  relation  of  subordination  or  equality  between  the  partici¬ 
pants,  as  well  as  their  proportional  attitudes  towards  the  communication  ( i . e . , 
belief,  knowledge,  images,  etc.). 


CONTEXT  OF  COMMUNICATION 


If  a  theory  of  properties  should  claim  to  be  empirically  relevant,  it  is  neces¬ 
sary  to  investigate  which  cognitive  processes  underlie  the  assignment  of  "appro 
priateness"  in  communicative  contexts.  We  should  examine  the  set  of  goals. 


beliefs  and  knowledge,  and  intentions  of  the  speaker  and  hearer,  as  well  as 
their  relationship  that  would  establish  the  type  of  interaction.  The  first 
thing  that  needs  to  be  established  is  the  "world-situation"  at  the  moment  of  the 
speech  act.  Some  types  of  speech  differ  in  strength  according  to  the  general 
goals  of  the  communication:  planning,  warning,  simulation,  recovery,  and 
acting  in  a  "world."  We  call  these  situation  "world-indices."  I  claim  that 
in  order  to  deal  with  this  variety  of  indexed  worlds,  we  should  assume  that 
the  illocutionary  force  is  a  fuzzy  set.  We  will  argue  this  point  later  on. 


Principle  1 :  The  hearer  and  speaker  should  be  inhabitants  of  the  same 
"indexed  world."  They  should  have  the  same  general  goal. 

Ex:  Recovery  versus  Simulation,  Planning,  and  Warning. 

The  goal  may  be  implicitly  known,  but  it  should  be  stated  by  one  of  the 
individuals  of  the  world. 

Principle  2:  The  set  of  indexed  worlds  is  a  partially  ordered  set, 
{planning,  simulation,  warning,  acting,  recovery},  and  the  "planning- 
world"  should  precede  all  the  other  worlds;  the  recovery-world  is  the 
last  one. 

If  a  planning-world  comes  after  recovery-world,  it  refers  usually  to  another 
"communicative  situation,"  for  which  the  previous  situation  could  be  a 
partial  cause. 

Principle  3:  In  planning,  we  should  consider  all  the  possibilities,  or 
in  other  worlds,  the  plan  should  not  make  the  difference  between  possible 
truths  and  necessary  and  actual  truths.  This  means  that  if  every  parti¬ 
cipant  in  the  planning  action  builds  a  "planning-world,"  the  "plan"  should 
be  a  world  accessible  from  each  of  those  other  worlds. 


In  the  following,  we  will  prepare  a  model  logic  system  stronger  than  the  known 

S  ,  called  S  +  A,  where  the  additional  axiom  (A)  NP  o  PN  ensures  the  existence 
u  u  p  p 

of  the  "plan"  in  the  system  of  "planning-world"  accessible  from  each  particular 
plan.  Following  that,  we  will  impose  some  constraints  on  the  universe  of  dis¬ 
course  of  the  "planning-world." 


1 

1 

< 

The  Logical  System  +  A 

The  basis  of  Su  +  A  is  as  follows: 

Primitive  Symbols 

p»g»r,...  :  proportional  variables 
■v.N  =  monniic  operators 
V  =  dyadic  operators 
(,)  =  brackets 

Formation  Rules 

FR1 :  A  variable  standing  alone  is  a  wff. 

FR2:  If  a  is  a  wff,  so  are  -a  and  Na. 

FR3:  If  a  and  £  are  wff,  so  is  (avg). 


Definitions 


[Def  A  ] 

(a 

A 

B)  : 

=  Df 

^B) 

[Defo] 

(a 

3 

6)  : 

=  Df 

(vx  V  £) 

[Def  =] 

(a 

= 

B)  : 

=  Df 

((a 

3  e)  . 

(B  3  a)) 

[Def  3] 

(a 

3 

B)  = 

=  Df 

N(a 

Bb) 

[Def  =] 

(a 

= 

B)  : 

=  Df 

((a 

B  B)  a 

(S*a)) 

Axioms 

I.  (The  axiomatization  of  the  propositional  calculus) 
A-j :  (pV  p)  D  p 
A2:  q  3  (p  V  q) 

A3:  (p  Vq)D  (q  V  p) 

A4:  (q  3  r)  3  ((p  V  q)  3  (p  V  r)) 
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II.  Np  3  p 


N(p  D  q)  (Np  >  Nq) 

III.  Np  3  NNp 

A.  NPp  3  PNp 

Rules 

TR1 :  The  rule  of  (uniform)  substitution  =  the  result  of  uniformly  replacing 
any  variable  in  a  thesis  by  an  wff  is  itself  a  thesis. 

Note:  By  thesis  we  mean  an  axiom  or  a  theorem  of  the  system. 

TR2:  The  rule  of  Modus  Ponens:  If  a  and  (a=B)  are  theses,  so  is  $. 

TR3:  The  rule  of  necessitation  (N):  If  a  is  a  thesis,  Na  is  a  thesis. 

Remark:  TR3  should  not  be  confused  with  the  invalid  wff  p^>  Np. 

I  will  present  the  semantic  model  for  Su  +  A  without  insisting  on  the  semantic 
models  in  general,  or  the  model  for  Su-  (There  is  a  vast  bibliography  of  world 
logic  where  further  information  may  be  found  [  ]). 

We  define  a  semantic  model  for  Su+A  as  an  ordered  triple  <W,  R,  V>,  where  W 
is  a  set  of  objects,  called  worlds;  R  is  a  binary  relation,  reflexive  and  transi¬ 
tive  definite  over  the  members  of  W;  and  V  is  a  value  assignment  satisfying  the 
conditions: 

(1)  For  any  propositional  variable  p^,  and  for  any  vt-,  which  is  a  member 
of  W,  either  V(p.,  w  )  =  a  or  V(p  ,  w.)  =  0. 

J  C  J  * 

(2)  For  any  wff,  a  ,  and  for  any  w..  e  W,  V(~a  ,  w..)  =  1  ,  if 
V( a,  wi )=0.  Otherwise,  V(~a,  wi)=0. 


SO 


(3)  For  any  wffs  a  and  8,  and  for  any  v^eW,  V((av8),  w^)=l  if  either 
V(a,  w- )=1  or  V(g,  w. )  1 ;  otherwise,  V((aVB),  w.-)=0. 

(4)  For  any  wff  a,  and  for  any  w..eW,  V(Na,  w..)=l,  if  for  every 
w •  e W  such  that  w.Rw.,  V(a,  w.)=l;  otherwise,  V(Na,  w-)=0. 

J  ^  J  J  * 

(5)  For  any  "centralized"  world,  wceW, 

(a)  there  exists  a  wff  Not  such  that  V(Na,  Wj ) =1  if  for  any 
wff  a,  V(a,  w. )=0  ; 

(b)  there  exists  a  wff  Na  such  that  V(Na,  Wj)=0  if  for  any 
wff  a,  V(a,  Wj)=0  ; 

(c)  there  exists  a  wff  a  such  that  V(a,  wj)=i  if  f°r  any 
wff  Na,  V(Na,  w^ )=1 . 

(d)  there  exists  a  wff  a  such  that  V(a,  wj)=0  if  f°r  any 
wff  Na;  V(Na,  w.)=0. 

J 

Condition  (5)  guarantees  that  the  model  distinctions  among  statements  in 
the  "centralized"  worlds  collapse. 

Definition:  A  wff  , 


In  the  following  we  will  prove  the  soundness  and  completeness  theorem.  Since 
the  system  that  we  proposed  is  a  modification  of  Su>  to  prove  that  the  model 
system  is  sound  on  interpretation,  we  need  only  to  prove  that  (A),  NPp^PNp 
is  logically  true. 

Let  us  suppose  that  it  is  not  true,  so  that  V(NPpi>PNp,  w..  =0.  If  follows 
that:  ' 


The  relation  R  between  worlds  is  reflexive;  consequently, 


(3)  V(Np,  w.)=0 
and  from  this 

(4)  V(p,  Wj)=0  . 

From  (1),  we  have 

(5)  V(Pp,  Wj)=l 
and  from  this 

(6)  V(p,  wk)=l. 

Continuing  on,  from  (2),  because  of  the  transitivity  of  R,  we  have 

(7)  V (Np,  wk)=0  . 

According  to  the  premises  of  Sy+A  model,  there  exists  a  world  (the 
"centralized  "  world)  wc»  which  is  accessible  from  any  other  world.  It 
is  obvious  that  this  world  is  wk,  as  wk  is  the  only  world  accessible 
from  all  other  worlds.  Therefore,  we  see  that  wk  is  accessible  from 
w,  and,  as  R  is  transitive,  it  is  accessible  from  w.  also.  Obviously, 

J  I 

it  is  accessible  from  itself.  We  have  also  seen  that  neither  wi  nor 
Wj  are  accessible  from  every  other  world;  Wj  is  accessible  from  only 
itself  and  w-  is  accessible  from  w.  and  from  itself.  Therefore,  since 

«J 

wk  is  a  "centralized"  world,  it  follows  from  (7)  that  there  exists  a 
wff,  p,  such  that  V ( p ,  wk)=0  .  But  this  contradicts  (6),  so  then 
V(NPpOPNp,  w.j)=l,  and  the  soundness  of  the  system  is  proved. 

In  order  to  prove  the  completeness  of  Su+A,  we  must  show  that  the  model 
distinctions  collapse  within  maximal  consistent  sets  corresponding  to 
"centralized"  worlds. 

Let  us  have  a  r.er  maximal  consistent  with  respect  to  S  +A.  If  r. 

J  ^  J 

corresponds  to  a  centralized  world  in  a  Su+A  model,  then  it  is  either 
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a  subordinate,  or  a  subordinate  of  subordinates  of  any  I\  e  r.  We  have 
to  show,  then,  that: 

(a)  if  8  e  r.,  then  Ng  e  r,  and  Pg  e  r.  , 

vJ  J  J 

(b)  if  Pg  e  r.,  then  g  e  F.  and  Ng  e  T-  ,  and 

J  J  J 

(c)  if  Ng  e  r.,  then  g  e  r.  and  Pg  e  r.  . 

J  J  J 

In  order  to  prove  (a)-(c),  we  will  utilize  the  following  lemmas  [  ]: 

Lemma  1 :  If  F  is  maximal  consistent  relative  to  a  model  system  s, 
then  for  any  wff  a,  neither  a  nor  -a  are  in  r. 

Lemma  2:  If  T  is  maximal  consistent  relative  to  a  model  system  s, 

then  for  any  wff  a,  either  a  e  r  or  ~a  e  r. 

Corollary:  Every  thesis  is  in  every  maximal  consistent  set. 

Lemma  3:  If  r  is  maximal  consistent  relative  to  a  model  system  s, 

then  for  any  wffs  a  and  g,  if  a  e  r  and  (a  g)  e  F,  g  e  F. 

Let  us  prove  (a).  If  8  e  T.,  then  because  PN(BoNg)  is  a  thesis  of  S  +A, 

J  “ 

if  follows  by  the  Corollary  of  Lemma  2  that  if  PN(goNg)  is  in  every  r^, 
then  it  is  in  Fi  also.  Therefore,  by  the  construction  of  r,  there  is  a 
subordinate  T-  such  that  N(g-^Ng)  is  in  r  .  But  because  r.  is  a  subor- 

I  C  J 

dinate  of  subordinates  of  any  r.,  it  must  be  that  goNg  e  r*.  Therefore, 

•  J 

by  Lemma  3,  it  follows  that  Ng  e  r..  g^Pg  is  also  a  thesis  of  S  +A,  so 

by  the  Corollary  of  Lemma  2,  goPg  is  in  r.  and  by  Lemma  3,  Pg  e  r.. 

J  J 

Let  us  now  prove  (b).  If  Pg  e  ,  then  because  PN(PgDg)  is  a  thesis  of 

Su+A,  it  follows  by  Lemma  2  that  PN(PgDg)  is  in  every  Thus,  by 

construction  of  r,  there  is  some  subordinate  such  that  N(Pgog)eF^. 

But  since  F.  is  a  subordinate  of  subordinates  or  of  a  subordinate,  then 
J 

Pg^g  e  r j ,  and  by  Lemma  3,  g  e  Tj.  As  we  have  seen  in  proving  (a), 

goNg  e  T.  and  by  Leircna.3,  Ng  e  r.. 

J  3 


Finally,  let  us  prove  (c).  If  Ng  e  F.,  then  because  Ngog 

J 

of  Su+A,  we  have  Ngog  e  r^,  and  by  using  Lemma  3,  g  e  r^.. 
also  a  thesis  of  S  +A,  and  so  Ng:?Pg  e  L.  By  Lemma  3,  Pg 

U  J 

the  completeness  is  proved. 


i 


is  a  thesis 
NgoPg  is 
e  r.,  and 

J 
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What  should  be  known  about  an  action,  or  a  chain  of  actions,  in  order  to  be 
able  to  deal  with  (to  communicate  )  them?  I  claim  that  the  following  three 
items  are  required: 

1)  First,  one  must  tell  the  state  in  which  the  world  is  in  (the  situa¬ 
tion  of  the  of  the  world)  at  the  moment  when  the  actions  initiate. 

I  call  this  the  initial  state. 

2)  Second,  one  must  tell  the  state  in  which  the  world  is  when  the 
action  is  completed.  I  call  this  the  end  state. 

3)  Third,  one  must  tell  the  state  in  which  the  world  would  be  if  the 
agent  (the  set  of  individuals  that  perform  an  action) 

I  call  states  (1)  and  (3)  together  the  acting  situation.  If  the  world  is 
initially  in  a  state,  and  no  agent  interfers,  then  there  is  no  opportunity 
for  either  destroying  this  state  or  letting  it  continue.  The  states  (1), 
(2),  and  (3)  determine  the  nature  of  the  action.  This  means  that  the 
nature  of  action  is  determined  by  the  acting-situation  and  the  result. 

In  the  notion  of  an  opportunity  of  action,  there  is  a  correlation  between 
an  actual  state  of  the  world,  resulting  from  the  action,  and  a  hypothetical 
state  of  the  world,  which  would  have  been  if  the  agent  had  not  acted.  The 
changes  of  the  states  of  the  world  would  be  described  by  the  operator  ' T' , 
called  "and  next";  and  the  correlation  between  the  actual  state  of  the 
world  and  that  which  it  would  be  is  described  by  the  operator  T  (instead 
of).  The  operators  T  and  I,  defined  on  the  set  of  states  of  the  world, 
behave  exactly  in  the  same  way,  and  by  applying  them  together,  we  get  the 
"Tl-calculus" .  T  and  I  function  exactly  as  binary  connections.  We  can 
consider  T,  I  reflexive  or  sometimes  reflexive  and  transitive.  This  second 
case  is  interesting  in  its  applications  (we  will  see  it  later). 


The  Axioms  of  Tl-Cal cuius 


Tl.  (pvgTr  vs)*-»(pTr)  v(gTr)  y(gTs) 

T2.  (pTg)A (pTr)-*pTg  Ar 
T3.  p^-*pTg\/~g 

T4.  ~ (pTgA~g) 

11.  (p  vglr  vs)fc—>(plr)  v(glr)  V(gls) 

12.  (pig)  A  (plr)-vpIgAr 

13.  p*-*pIgV/~g 

14.  ~(pIgA~g) 

Inference  in  the  calculus  proceeds  through  substitution  of  formulae  for 
variables,  detachment  and  replacement  of  the  expressions  by  provable  equi¬ 
valent  expressions. 

We  call  the  connectives  * T '  and  T  coordinators  of  the  possible  states  of 
the  world  (or  of  possible  worlds  if  you  like).  'T1  coordinates  the  world 
as  it  is  now,  with  the  world  which  will  be  next,  and  1 I'  coordinates  the 
world  as  it  is  with  an  agent  with  the  world  as  it  would  be  if  the  agent 
remained  passive. 

By  agent  in  this  sense  we  mean  the  groups  of  individuals  who  intentionally 
and  consciously  make  the  decisions  of  what  to  do,  when,  where,  how  to  act. 
In  other  words,  the  agent  is  the  initiator  of  the  action. 

The  general  form  from  which  a  description  of  action  may  become  extracted 
is  "_T(_I_)",  where  the  blanks  are  filled  with  the  states  of  the 
world.  Speaking  of  the  "world",  we  have  to  take  into  account  the  universe 
of  the  discourse  that  is  constituted  by  the  elements  that  participate  in 
the  description  of  the  world,  as  it  is  and  as  it  could  be  after  a  change 
(catastrophy,  disastor  of  all  sorts,  etc.).  Obviously,  the  elements  that 
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we  operate  with  are  those  from  the  real  or  hypothetical  world  that  are  rele¬ 
vant  only  to  the  "indexed  world"  which  we  are  talking  about  (the 


Principle  4:  All  the  indexed  worlds  have  similar  universes  of  dis¬ 
courses  that  are  not  disjoint. 

Let  us  consider  that  the  universe  is  of  width  n.  There  are  2nx2nx2n(or  2^n) 
possible  ways  of  filling  the  blanks  with  state  descriptions.  Let  s^,  s^, 
and  sk  be  state  descriptions  (not  obligatorily  different)  in  the  universe. 
The  expression  s^Tfs-Is^)  is  equivalent  to  a  conjunction  of  n  expressions 
for  elementary  actions,  one  elementary  action  for  each  of  the  n  elements  of 
the  universe.  The  compound  of  n  elementary  actions,  distributed  to  the 
agent  in  question,  is  called  a  total  action.  For  example, 

"a^A-va^-s/a^ A a^I^A^a^)"  describes  the  course  of  action  which  an  agent 
chooses  when  he  lets  one  of  the  two  states  vanish  and  produces  the  other. 

If  we  express  it  by  the  conjunction  (a^T^a-j  I^a-j  ))A(~a2T  (a^I-'a^)),  each 
element  of  the  conjunction  describes  what  we  call  an  elementary  action 
(or  omission). 

Definition:  The  succession  of  total  states  through  which  the  world  passes 
is  called  a  history.  A  history  tells  what  happens  in  the 
world  in  which  there  exists  certain  agents. 

Remark:  The  history  doesn't  tell  which  courses  of  action  the  agent  chooses 
at  various  times.  In  order  to  know  this,  we  have  to  know  how  the 
world  would  have  changed  from  one  state  to  the  next  had  it  not 
been  for  the  agent. 

Let  us  suppose  the  possible  states  of  the  world  are  2n,  and,  the  length  of 
histories  being  m,  the  total  number  of  histories  is  2  . 

We  have  spoken  only  about  the  case  in  which  we  gave  one  agent.  There  might 
be  as  well  a  group  of  individuals  carrying  out  the  same  actions,  working 
together,  deciding  together,  etc.).  Most  of  the  time  we  do  have  more  than 
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one  agent,  and  these  agents  can  either  cooperate  or  contradict  each  other. 
In  the  following  paragraphs,  we  shall  discuss  the  interaction  of  agents. 

The  interaction  of  agents  turns  out  to  be  very  important  in  the  study  of 
communication.  The  interaction  of  agents  is  described  by  iterating 

operator  I.  We  then  have  an  expression  of  the  form  *_T ( _ I ( _ I ( _ I ) ) ) * ,  where 

the  introduction  of  each  ' I '  refers  to  the  state  of  the  world  in  which 
one  agent  would  act  and  not  the  others. 

I  shall  define  here  the  notion  of  normative  system,  by  which  I  mean  a 
class  of  norms  which  stem  from  the  same  "source".  This  "source"  is  a 
set  of  goals  (see  Principle  1,  which  states  that  the  common  goals  of  a 
set  of  individuals  set  them  together  in  the  same  "universe  of  discourse" 
or  basis  for  the  "indexed  worlds"). 

Sometimes  the  "source"  can  be  some  authority  who  issues  norms  for  a  group 
of  people,  as,  for  example,  in  a  of  a  disaster  when  the  presi¬ 

dent  of  a  country  enforces  a  law  by  his  order  only  that  has  to  be  executed 
at  each  level . 

Definition:  An  action,  or  a  chain  of  actions,  is  _ .  determined 

in  a  system  s,  when  it  is  either  permitted  or  forbidden  in  this  system. 

This  definition  brings  us  back  to  the  external  principles  of  a  communica¬ 
tion  system,  namely  to  the  maxim  of  relation  that  requires  that  the  con¬ 
tent  of  a  communication  (the  actions  required  or  reported  by  the  comnuni- 
cative  set)  should  be  relevant  to  the  goal  of  the  communication. 

Definition:  A  normative  system  is  closed  if  every  action  is 
determined  in  the  system.  A  system  which  is  not  closed  is  open. 

Principle  5:  In  a  ;stress  situation,  the  system  of  communication  has 
to  be  closed.  By  that  I  mean  that  at  each  level  every  action  is 
determined  by  a  system  of  norms  of  communications. 
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Remark:  It  is  possible  for  closed  systems  to  be  under  complete  control. 

Remark:  We  can  distinguish  between  an  action  that  is 

determined  and  a  state  of  the  indexed  world  being 
determined. 

Definition:  A  state  of  an  indexed  world  is  deontically  determined  in  a 
system  if  it  is  permitted  or  forbidden  for  this  state  to 
exist.  In  a  way,  it  is  the  same  as  stating  that  the 
indexed  world  is  under  control. 

Remark:  We  have  to  distinguish  between  the  ontic  problem,  where  the  reality 
of  the  norms  lie  and  what  is  required  for  a  norm  to  exist,  and  the 
epistemic  problem,  which  is  how  we  come  to  know  about  the  existence 
of  norms,  where  "how  we  come  to  know"  means  how  we  come  to  decide, 
establish,  etc.  the  existing  norms. 

In  the  following,  I  will  propose  a  system  of  epistemic  logic  that  has  as 
its  universe  of  discourse  a  system  of  norms  which  underlie  the  communica¬ 
tive  system.  The  individuals  participating  are  the  agents  defined  above, 
and  the  type  of  knowledge  that  they  possess  is  related  to  the  "quality"  of 
communicational  relations,  to  its  efficiency  and  successful  ness. 


The  subject  matter  of  epistemic  logic. 

The  subject  matter  of  epistemic  logic  is  best  viewed  as  an  explanatory 
model,  in  terms  of  which  certain  aspects  of  natural  language  can  be 
understood.  This  explanatory  model  may  be  thought  of  as  bringing  out  the 
"depth  logic"  which  underlies  the  complex  realities  of  the  ordinary 
use  of  epistemic  terms  such  as  "to  know,"  and  in  terms  of  which  these 
complexities  can  be  accounted  for.  It  therefore  does  not  represent  a 
proposal  to  modify  ordinary  language,  but  rather  an  attempt  to  under¬ 
stand  it  more  fully.  But  this  explanatory  model  does  not  simply  re¬ 
produce  what  there  is  to  be  found  in  ordinary  discourse.  As  is  the 
case  with  theoretical  models  in  general.  It  does  not  seem  to  be  de¬ 
rivable  from  any  number  of  observations  concerning  ordinary  language. 
Epistemic  logic  cannot  concern  itself  with  actual  occurent  knowledge. 

It  must  deal  with  virtual  or  implicit  knowledge,  that  knowledge  which  a 
knower  can  in  principle  come  to  have,  what  a  knower  can  in  principle 
determine  to  be  the  case  in  conjunction  with  what  he  explicitly  or 
implicitly  knows. 

Epistemic  principles. 

An  absolutely  undisputed  principle  of  epistemic  logic  is  that  one  cannot 
know  what  is  false;  so 

PI)  What  is  known  must  be  the  case. 

If  an  individual  a  knows  that  a  proposition  p  is  the  case  and  did  not 
know  that  q,  then  it  would  be  implausible  to  maintain  that  he  knows  that 
p  implies  q;  some  have 

P2)  What  is  known  to  follow  from  the  known  is  itself  known. 

We  may  sometimes  suppose  that  in  a  given  system  S  and  individual  a  knows 
all  the  logical  consequences  of  what  he  knows;  so 

P3)  What  follows  logically  from  the  known  is  known. 

We  can  strengthen  the  previous  concept  by  dropping  the  requirement  that 
p  implies  q  be  provable  in  a  given  system  S  and  requiring  instead  that 
P4)  What  is  demonstratable  is  known. 

If  we  consider  inferences  of  the  form:  from  p  is  the  case  we  deduce 
that  an  individual  a,  knows  p,  by  replacing  p  with  a  wff  of  the  form  Kap, 
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or  ^Kap  we  obtain  the  following  principles: 

P5)  What  is  known  is  known  to  be  known 
P6)  What  is  unknown  is  known  to  be  unknown. 

Remark: 

The  difference  between  P5)  and  P6)  is  that  in  the  last  one  the 

individual  a  must  know  that  the  inventory  is  complete,  so  that  if  he  does  not 

find  P  in  the  inventory,  then  he  will  know  that  he  does  not  know  that  p. 

In  the  following  paragraphs  we  shall  consider  some  systems  of  epistemic  logic 
that  arise  by  the  embodiment  of  the  principles  considered  above. 

Epistematic  systems  in  axiomatic  perspective. 

In  the  construction  of  the  epistemic  systems  we  suppose  satisfied  the 
two  valued  propositional  calculus.  (PC) 

Notations: 

1)  the  propositional  variables:  p,q,r... 

2)  the  connectives:  'V,  ' Ka ’  (a  knows),  1  Ba *  (a  believes) 

The  other  connectives  are  defined  in  the  usual  way.  We  define  epistemic 
possibility  for  a  by  Pa. 

'Pap'  is  read  'it  is  possible  for  a  to  know  p'. 

We  note  by  '=>'  the  inferences  authorized  by  the  inferences  rules.  Upper 
case  letters  are  variables  over  formulas. 

Some  Epistemic  systems. 

I  will  mention  the  most  widely  used  systems: 

T  is  PC+  (Kl):  -  Kap  +p 

(K2):  -  Ka(|>+q)-*-(Kap->-Kaq) 

(K3):  -  p=>:-Kap 

54  is  T  +  (K4) :  -  Kap+Ka(Kap) 

55  is  T  +  (K5) :  -  ^Kaf^Ka(^Kap) 

The  basic  notion  of  a  semantical  theory  is  normally  the  notion  of  truth. 
However,  given  a  set  of  formulas,  we  are  not  interested  here  in  determining 
whether  they  are  true  under  some  particular  interpretation,  but  rather  in 
determining  whether  they  are  true  under  any  interpretation  at  all.  Thus, 
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we  choose  the  basic  concept  of  our  semantic  theory  to  be  satisfiability. 

If  the  negation  of  a  formula  A  is  not  satisfiable,  A  is  said  to  be  valid. 

We  define  the  satisfiability  of  a  finite  set  of  formulas  (with  the  epistemic 
operator)  as  the  capability  of  being  true  under  some  state  of  affairs. 

Possible  worlds. 

We  can  think  of  possible  worlds  as  possible  situations  in  which  certain  states 
of  affairs  obtain,  so  that  certain  propositions  --  those  asserting  these 
state  of  affairs  --  are  true.  Propositions  that  characterize  possible 
epistemic  worlds  are  propositions  not  only  about  what  is  objectively  the  case, 
but  also  about  what  is  known  or  not  known  in  those  worlds. 

Notations. 

We  shall  use  for  'if,  then'  and  '<->'  for  'if  and  only  if.'  We  shall 
use  'A',  ' B ' ,  'AT.  ' A2 ' ,  etcetra  for  variables  over  formulas,  and  'w'. 

' k ' ,  'm',  etcetra  for  variables  over  sets  of  formulas. 

We  note  by  S  one  of  the  systems  under  discussion:  PC,  T,  S4,  or  S5. 

S*  *  (A:  A  is  provable  in  S} 

[w]  =  (A:  KA  is  in  w} 

<W>  =  (A:  ^Ka^A  is  in  w} 
w  is  a  PC  world  <-> 

1)  w  is  maximal:  A  is  in  w  or  ^A  is  in  w 

2)  w  is  consistent:  A  is  not  in  w  or  A  is  not  in  w 

3)  w  is  a  filter:  A&B  is  in  w  <->  A  is  in  w  and  B  is  in  w 

This  definition  introduces  the  idea  of  a  possible  world  construed  as  the 
set  of  all  propositions  true  in  that  world  rather  than  as  a  single  con¬ 
junctive  proposition  uniting  the  above  requirements.  We  can  replace 
condition  3)  by  the  following  two  requirements: 

4)  w  is  closed  under  MP  (modus  ponens) 

5)  PC*  is  a  subset  of  w 


Exercise: 

Given  1)  and  2),  prove  the  equivalence  3)  <->  4)  and  5). 

For  the  ease  of  notation  and  for  the  convenience  of  refering  to  the  phil¬ 
osophical  issues  related  to  the  epistemic  logic,  we  introduce  a  type  of 
possible  world,  called  0-world. 
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w  is  an  O-world  <-> 

1)  w  is  a  PC-world 

2)  M  is  a  subset  of  w 

3)  [w]  is  MP  closed 


Remark: 

The  conditions  2)  and  3)  require  the  satisfaction  of  axioms  (Kl)  and 

(K2). 

Condition  (A): 

If  we  note  by  S  one  of  the  systems  PC,  0,  T,  S4,  S5  then 

w  is  an  S-world  <->  1}  w  is  maximal,  consistent  and  MP  closed 

2)  S*  is  a  subst  of  w. 

Given  the  following  definitions: 

1)  A  set  w  is  S-consistent  <-> 

[If  A1 ,  A2,...,  An  belong  to  w 

then  ^(Al&...&An)  does  not  belong  to  S*U 

2)  E(S)  =  (w:  w  is  maximal  and  S-consistent} 

3)  Given  an  ordering  of  all  formulas,  AO,  A1 ,  A2,  . ..Ai, 

and  given  a  set  w,  we  define  a  sequence  of  sets  as  follows: 
f(S,  w,  0)  =  w 
f(S,  w,  i+1)  = 

(f(S,  w,  i)  u  {Ai}}  if  f(S,  w,  i)  u  {Ai}  is  S-consistent 
{f{S,  w,  i)  u  NAi}}  otherwise. 

4)  s(S,  w)  =  uf(S,  w,  i)  (i  >=  0) 
and  the  assumptions: 

(Cl)  PC*  is  a  subset  of  S* 

(C2)  S*  is  MP  closed. 

We  have  the  following  Lemmas: 

1)  w  is  S-consistent  ->  e(S,  w)  is  maximal  and  S-consistent. 

2)  w  is  maximal  and  S-consistent  <-> 

w  is  maximal,  consistent,  and  MP  closed,  and  S*  is  a  subset  of  w. 

3)  A  is  contained  in  S*  <->  A  is  contained  in  the  intersection  of  E(S). 

4)  A  is  contained  in  S*  <->  A  is  contained  in  the  intersection  of 

{w:  w  is  maximal,  consistent,  MP  closed  and  S*  is  a  subset  of  w}. 
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5)  w  is  a  T-world  <->  w  is  contained  in  E(T). 

6)  w  is  a  S4-world  <->  w  is  contained  is  E(S4). 

7)  w  is  a  S5-world  <->  w  is  contained  in  E(S5). 

Remark: 

The  Lemmas  5-7,  via  the  lemma  2  constitute  the  proof  for  Condition  (a) 
above. 

Proof: 


Lemmas: 

1)  a  is  S-consistent  =  e(S,a)  is  maximal  and  S-consistent. 

F  Let  a  be  S-consistent.  e(s,a)  is  maximal 

by  contradiction:  e(S,a)  -  S-consistent 
we  show  that  K  is  S-consistent  =  Ku { F } 1 S 
S-consistent,  or  Ku{>F}  is  S-consistent 

2)  a  is  maximal  and  S-consistent  <=> 

a'is  ux-j  consistent,  up  -  closed,  and  S->-ea. 

[proof  from  and  C ^ 

3)  F  e  S*  (=;  F  e  m  (S) . 

F  f  S  -*■  =>  false  L-2,  Feilni  (S). 

If  F  t  S-*-,  then  by  (C-|)  or  (C2),  'vuF  t  S*. 

=>  {'vF}  is  S-consistent,  by  Lemme  1. 

£(S,('V/F})e  m(S)  =>  for  some  Ke  m(S). 

4)  F  c  S+  (M  c  il  {  a  =  a  is  maximal, 
com,  up  -  ilsid,  oud  S*  _<  ay. 

C=H  from  2  oud  3) 

5)  a  i j  a  T-world  <=>  a  e  m  CT). 

+  "f  a  maximal  and  T-consistent,  then  a  is  e. 

T-world  since  by  lemme  2  and  lemme  4,  m(+)  is  a  T-world  structure. 

6)  a  is  an  Sy-world.  (=)  a  e  m(Sy). 

7)  a  is  an  S5-world  (=)  a  c  m(S5). 
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While  considering  the  features  (+active),  (+  consciousness),  (+  initiative) 

I  propose  a  separation  of  the  so-called  "Agents"  into  two  :lasses:  "Agents" 
and  "Patients."  Each  of  these  classes  will  have  three  members.  We  distin¬ 
guish  the  "Agents"  from  "Patients"  by  the  presents  of  the  (+active)  in 
"Agents"  and  (-active)  in  "Patients." 

The  two  classes  of  "Agents"  and  "Patients"  are  symetrical  so  they  contain: 
a!)  Initiating  Agents  (Ai)  or  Initiating  Patients  (Pi), 
characterized  by  (+initiative,  +  consciousness) 
a2)  Medium  Agents  (Am)  or  Medium  Patients  (Pm), 

characterized  by  (+consciousness,  -  initiative) 
a3)  Final  Agents  (Af)  or  Final  Patients  (Pf), 

characterized  by  (-consciousness  and  -initiative). 

By  the  feature  (+consciousness)  I  mean  not  only  that  the  "Agents"  or 
"Patients"  are  aware  of  what  they  do,  but  also  that  they  know  how  to  do 
it,  and  why  they  do  it,  etcetra. 

The  "Final  Agent"  or  "Final  Patient,"  by  having  consciousness,  can  act  only 
by  being  manipulated  by  an  Initial  or  Medium  "Agent." 

For  the  sake  of  clarity,  I  name  each  participant  in  the  following  manner: 
the  (Ai )-causitor,  the  (Am)-agent,  the  (Af)-instrument,  the  (Pi)-source, 
the  (Pm)-patient,  and  the  (Pf)-benefactor.  The  naturalness  of  these  names 
is  obvious;  e.g.,  the  (Ai),  by  having  initiative  and  being  active  causes 
events  to  happen,  the  (Am),  by  being  active  and  having  consciousness  does 
things,  etcetra.  I  introduce  these  concepts  in  order  to  establish  the  dynamic 
relations  urging  the  participants  to  a  "communication  act." 

These  are  some  other  specifications  needed: 

1)  The  "Patients"  virtually  double  the  "Agents."  Under  appropriate 
conditions  they  can  jump  from  the  possible  to  the  active  state. 

2)  I  propose  to  represent  the  feature  (+consciousness)  by  the 
epistemic  attitude  of  the  individual  to  the  states  of  the  universe 
of  discourse. 

3)  The  feature  (+initiative)  refers  to  the  choice  of  a  particular 
action  out  of  several  alternatives  in  a  given  situation.  I  will  represent 
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in  the  language  of  deontic  logic  dividing  the  actions  to  the  "Agent" 
or  "Patient"  in  a  particular  situation  into  three  categories:  permitted, 
obligatory,  and  forbidden. 

Let  us  have  the  situation  P  and  0  and  represent  persuasion  and  obligation 
and  let  us  note  the  individual  by  "x"  and  the  action  in  question  by  "a". 

Definition: 

1)  x  e  {Ai,Pi},  iff  Pxav^Pxa; 

2)  x  e  {Am, Pm},  iff  PxavOxa; 

3)  x  e  {Af,Pf},  iff  Oxa. 

Remark: 

1)  The  "Agent"  or  "Patient"  (Ai,Pi)  has  complete  freedom  of  action  to 
such  a  point  that  he  can  break  the  previous  norms  and  do  actions  that 
were  not  supposed  to  be  done  in  that  particular  situation. 

2)  The  "Agent"  or  "Patient"  (Am, Pm)  has  legally  limited  freedom  of 
action;  e.i.,  he  can  perform  actions  permitted  or  obligated  by  the 
system  of  norms  that  is  instantiated. 

3)  The  "Instrument"  and  "Befeniciary"  (Af,Pf)  can  perform  only 
obligatory  actions,  in  other  words,  they  have  to  do  exactly  what  is 
drawn  for  them  to  do.  They  do  not  have  any  freedom  of  choice  with 
regard  to  the  action. 

Remark: 

In  the  case  of  Ai  and  Pi  by  "freedom  to  choose"  I  mean  that  they  must  impli¬ 
citly  assume  the  risk  of  their  action. 

An  example  of  this  would  be;  a  change  of  plan  in  a  dangerous  situation 
where  one  of  the  individuals  decides  to  act  in  a  different  way  than  it  was 
pre-establ ished. 

The  epistemic  attitude  of  the  individuals  participating  in  an  act  of 
communication  leeds  to  the  structuring  relation  of  their  epistemic 
universe  that  represents  their  state  of  knowledge  about  that  particular 
situation. 
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For  this  situation  I  shall  give  an  example  of  the  theory  proposed  above.  Let 
us  imagine  a  situation  in  which  a  group  of  people  are  preparing  a  conspiracy 
against  the  president.  One  of  them  is  an  "Agent",  (a  "cop"),  however,  who  will 
cause  the  failure  of  the  conspiracy  and  the  destruction  of  the  group. 

We  can  break  this  situation  into  three  specific  parts: 

1)  The  "Agents"  perceive  the  goal  of  this  conspiracy.  They  will  use  the 
epistemic  rule,  (K)  Ka  =  >  l*Kx  a  which  implies  the  structuring  of  this 
universe,  by  the  epistemic  system  T.  As  this  stage,  the  "Agent"  is  the 
source  of  the  future  destruction  of  the  conspiracy,  so  he  is  the  (Pi). 

The  conspirators,  who  have  not  observed  the  spy  in  their  presence,  and  be¬ 
lieve  they  are  safe,  plan  to  act.  Ignorant  of  the  spy  they  don't  take  and 
initiative  to  supress  him.  It  is  clear  that  at  this  point  the  conspirators 
are  AM  because  of  the  reasons  mentioned  above.  (They  can't  be  Ai  as  that 
would  solve  the  problem.) 

2)  The  spy  becomes  active  (he  has  enough  desire  to  act)  and  accusses  the 
conspirants.  At  this  point  Pi  becomes  Ai.  The  president,  the  target  of 
the  conspiracy,  is  not  aware  of  any  of  these  actions,  therefore,  he  cannot 
have  any  initiative.  He  knows  only  what  the  spy  tells  him,  thus,  his  epis¬ 
temic  universe  is  structured  by  an  0  system.  The  president,  as  goal  of  the 
conspiracy,  is  an  Af.  He  changes  his  status  from  Pm,  the  "Patient,"  who 

is  supposed  to  support  the  effect  of  the  conspiracy,  to  an  Af.  He  is  an 
instrument,  manipulated  byt  the  spy  who  wants  to  save  him.  In  the  next  moment 
Af  becomes  Am,  in  other  words,  an  "Agent,"  who  knows  of  a  conspiracy  against 
himself.  In  his  position  as  president  he  can  order  the  punishment  of  the  con¬ 
spirators. 

We  can  see  that  the  spy  "Agent"  dominates  the  president  by  the  former's 
knowledge  of  the  situation.  The  spy  causes  the  transformation  of  the 
conspirators.  At  the  end  of  the  story,  the  "Agent"  as  a  "Beneficiary" 

(Pf)  reaches  a  passive  state. 
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SECTION  VI 


TRANSPORTATION  SYSTEM  FOR  CIVIL  DEFENSE 


99 


TRANSPORTATION  SYSTEM  FOR  CIVIL  DEFENSE 


In  this  preliminary  report  the  comparison  between  the  transportation  system 
of  a  nuclear  preparedness  system  (NPS)  and  a  peacetime  preparedness  system 
(PPS)  is  examined,  several  problems  are  discussed,  and  implications  of  the 
transportation  system  as  well  as  a  preparedness  system  are  also  examined. 

In  most  cases,  definite  conclusions  are  avoided  and  areas  where  future 
research  is  needed  are  indicated. 

Before  a  comparison  of  systems  is  made,  the  control  maps  are  explained. 

One  control  map  is  of  the  transportation  system  of  NPS  and  the  other  is  the 
transportation  system  of  PPS.  They  represent  that  part  of  the  preparedness 
system  in  which  people  are  relocated  from  an  area  of  potential  danger  to  an 
area  of  safety,  and  equipment  and  supplies  are  also  moved  to  the  host  areas. 
This  is  not  a  representation  of  post-relocation  movement  nor  is  it  a  rescue 
system. 

In  each  system  (peacetime  and  nuclear),  "transportation"  is  viewed  as  a 
function  from  a  certain  matrix  of  data  types  to  another  matrix  of  data  types. 
The  rows  of  the  matrices  from  top  to  bottom  are,  respectively,  people-place¬ 
time,  equipment-place-time,  and  suppl ies-place-time.  In  the  case  of  the  top 
row.  Transport  maps  people  from  a  place  (call  it  p^)  at  time  (t^)  to  the 
triple,  people  (identical  with  input)  to  a  place  (p2)  arriving  at  time  (t2), 
where  p1  ?  p2,  and  t2  is  later  than  tj.  Transport  acts  similarly  on  the  other 
two  rows.  Note  that  Transport  does  not  alter  the  first  column  of  the 
matrices;  people,  equipment,  and  supplies  remain  the  same,  only  the  places 
and  time  change.  This  is  intuitively  satisfying. 

The  primitive  functions  are  fairly  obvious.  For  instance,  "AUTO"  says  that 
people  will  travel  by  automobile  from  a  place  at  a  particular  time  to  a 
new  place  at  a  later  time.  AIR,  RAIL,  WALK,  BUS,  and  TRUCK  are  interpreted 
similarly.  It  should  be  noted  that  short,  perhaps  intracity  travel  by  auto, 
truck,  or  bus  are  omitted  in  the  nuclear  preparedness  control  map.  So  those 
leaving  by  air  may  have  been  transported  by  auto  to  the  air  terminal,  but 
the  auto  trip  is  omitted  unless  it  is  longer  than  some,  yet  unspecified* 
distance.  However,  a  control  map  can  be  made  such  that  all  travel,  no 
matter  how  short,  can  be  represented. 
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The  data  types  will  need  to  be  specified,  but  this  is  work  in  progress. 
Roughly,  "shelters"  mean  some  sort  of  protective  housing  for  people,  "ware¬ 
houses"  are  places  where  equipment  is  stored,  "distribution  points"  are 
structures  in  which  supplies  are  stored  and  from  which  supplies  are  dis¬ 
tributed  to  shelters.  Time  has  already  been  given  an  HOS  specification. 

The  meaning  of  "place"  is  not  yet  completely  clear.  It  will  have  to  do  with 
geographic  regions  from  where  and  to  where  people,  equipment,  and  supplies 
are  transported.  So  some  places  are  in  risk  areas  while  others  are  in  host 
areas.  Thus,  places  may  contain  shelters,  warehouses,  and  distribution 
points.  By  "supplies,"  it  is  meant  food,  water,  bedding  (cots,  blankets, 
pillows,  sleeping  bags),  medical  supplies,  sanitary  supplies,  fuel,  etc. 
"Equipment"  includes  things  such  as  decontaminating  devices,  tools,  trucks, 
firefighting  equipment,  certain  industrial  equipment,  etc.  Again,  "equip¬ 
ment"  and  "suppl ies"  must  be  made  clear  and  a  specification  made  explicit. 
Further  discussion  of  these  data  types  will  appear  below. 

Within  an  HOS  control  map,  some  differences  and  similarities  of  the  trans¬ 
portation  system  within  NPS  and  PPS  are  made  explicit.  As  to  be  expected, 
the  system  in  NPS  looks  more  elaborate  than  the  one  in  PPS.  Air  and  rail 
transport  play  a  part  in  one  (NPS)  while  it  is  absent  in  the  other  (PPS). 
Maybe,  more  importantly,  in  the  control  map  for  NPS  there  are  multi-transports 
(transports  by  auto  or  truck  followed  by  air  or  rail)  while  there  are  no 
such  moves  in  PPS.  With  the  exception  of  those  walking  to  shelters  (very 
small  number),  all  of  the  transportation  of  people  in  response  to  a  natural 
disaster  is  by  roadways.  Depending  on  the  size  of  the  disaster,  air  and 
rail  may  be  needed  to  bring  in  supplies  and  equipment.  Although  much  of 
the  travel  in  response  to  a  nuclear  crisis  will  be  by  roadways,  transporta¬ 
tion  is  not  limited  to  these  means.  At  present,  transportation  by  water 
is  absent  for  both.  The  differences  will  be  explained  once  the  data  types 
are  fully  specified. 

The  purpose  of  a  transportation  system  in  a  preparedness  system  is  to  trans¬ 
port  people  from  high  risk  to  low  or  no  risk  areas  and  to  transport  necessary 
equipment  and  supplies  to  the  host  areas.  Due  to  the  fact  that  natural 
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disasters  are  localized  to  a  particular  geographical  area  (in  contrast  with 
nuclear  attack),  the  difference  traveled  between  the  disaster  area  and 
safety  (shelter)  is  generally  shorter  than  the  distance  traveled  in  case 
of  nuclear  attack.  This  difference  must  be  captured  in  the  data  types  of 
Place.  Similarly,  time  traveled  is  generally  shorter  in  relocating  due  to 
an  impending  natural  disaster  than  for  nuclear  attack.  Again,  this  may  be 
handled  by  additional  properties  for  the  data  type,  Time. 

Transportation  of  people  particularly  in  NPS  must  not  only  look  at  quantity 
for  any  given  sheltering  site,  but  also  at  the  professions  of  those  being 
relocated.  For  example,  it  must  be  guaranteed  that  there  will  be  trained 
medical  personnel  (doctors)  at  all  sites.  Furthermore,  workers  who  must 
keep  certain  industries  functioning  during  the  crisis  must  be  transported 
to  the  sites  of  their  relocated  workplaces  and  not  in  shelters  too  far 
to  commute  during  the  crisis.  In  PPS,  this  is  not  as  important,  since 
doctors,  for  example,  can  be  made  available  from  outside  the  risk  areas. 

(See  "directionality  of  help"  discussion  below.) 

Another  difference  that  is  clear  is  the  type  of  shelters.  The  shelters 
in  NPS  must  have  the  properties  of  being  blast-resistant  and  fallout-proof. 
Thus,  the  design,  construction,  and  materials  used  in  the  construction 
must  be  such  to  satisfy  these  properties.  This  contrasts  sharply  with  those 
shelters,  usually  relief  centers,  that  are  used  in  PPS.  These  shelters 
frequently  are  no  more  than  church  basements,  schools  (gymnasiums),  hotels, 
or  other  large  buildings  that  may  not  qualify  as  fallout  shelters.  Also, 

because  natural  disasters  are  localized,  the  number  of  people  affected  are 
small,  so  the  number  and  size  of  shelters  (as  well  as  the  amount  of  sup¬ 
plies  and  pieces  of  equipment)  in  PPS  will  be  small  as  compared  with  NPS. 

Along  similar  lines,  supplies  differ  within  the  two  systems.  In  order  to 
cope  with  fallout,  certain  number  of  items  such  as  radiation  detectors 
must  be  included  in  NPS.  If  supplies  are  prepared  in  a  "kit"  form,  i.e., 
a  package  containing  various  personal  supplies  (e.g.,  blankets,  toiletries) 
then  it  is  important  to  build  such  kits  in  order  to  avoid  having  a  duplication 
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of  articles  in  supply  kits  for  NPS  and  PPS.  One  way  to  do  this  would  be 
to  construct  survival  kits  containing  supplies  needed  by  people  in  both 
systems.  In  addition  to  these,  supplementary  kits  (with  personal  radiation 
detection  buttons)  should  be  constructed  to  be  distributed  with  the  basic 
kits  in  times  of  nuclear  emergencies.  (This  procedure  rests  on  the  assump¬ 
tion  that  personal  supplies  needed  in  peacetime  relocation  are  needed  in 
nuclear  relocation.)  Quantity  of  kits  must  also  be  taken  into  account. 
Massive  evacuations  will  require  kits  to  be  on  hand,  since  production  of 
new  ones  will  be  slow  or  nonexistent. 

As  mentioned  above,  the  distance  over  which  transportation  takes  place 
will  be  greater  in  nuclear  crisis  evacuations.  Consequently,  air  and 
rail  transport  will  play  some  role  (how  large  a  role  is  unclear  in  present 
literature)  in  this  type  of  massive  relocation.  Since  the  distance  from 
a  (natural)  disaster  area  to  safety  is  usually  just  a  few  miles  and  time 
is  short,  air  and  rail  transport  is  not  practical  in  PPS.  So  multi  transports 
are  ruled  out.  With  respect  to  water  travel  (barges,  private  vessels, 
fishing  boats,  etc.),  it  is  doubtful  that  it  can  prove  feasible.  Water 
travel  is  time  consuming.  Furthermore,  it  leads  nowhere,  i.e.,  shelters, 
distribution  points,  and  warehouses  are  all  inland,  not  along  the  coast. 
Travel  along  the  coast  would  be  absurd  in  times  of  nuclear  crisis.  Re¬ 
location  is  away  from  the  coast  (risk  area),  not  along  it.  In  the  case  of 
inland  water  travel  (e.g.,  Great  Lakes,  Mississippi  River),  the  literature 
is  unclear  again.  Probably  very  little  if  any  travel  would  be  possible. 

Many  of  the  major  cities  along  the  Great  Lakes  would  be  prime  target  areas, 
so  movement  would  be  away  not  between  them. 

Directionality  of  help  is  seen  to  be  a  difference  between  the  two  systems. 

As  areas  of  the  country  are  evacuated,  movement  tends  to  be  away  from  the 
coasts.  Furthermore,  in  NPS  supplies  and  equipment  move  in  the  same 
direction.  However,  in  a  natural  disaster  movement  of  people  is  away  from 
the  disaster  area  and  supplies  and  equipment  come  to  the  shelterees  from  the 
opposite  direction  in  which  the  shelterees  arrive.  With  a  simplified 
sketch,  in  NPS, 
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are  in  the  risk  areas  and  are  being  transported  in  roughly  the  same  direction. 
In  PPS, 
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where  people  are  leaving  the  danger  area  in  one  direction  and  from  another 
direction  (not  within  the  danger  area)  the  supplies  and  equipment  are  trans¬ 
ported. 

This  is  worth  noting  for  several  reasons.  Decisions  should  be  made  to 
build  warehouses  and  distribution  points  in  order  to  keep  a  limited 
amount  of  supplies  outside  of  potential  natural  disaster  areas  such  that 
shipment  could  be  made  quickly  to  these  areas  in  times  of  emergencies. 

The  location  of  these  warehouses  and  distribution  points  besides  being 
outside  of  potential  disaster  (natural)  areas  should  be  located  in  the 
host  areas  for  nuclear  crisis.  In  that  way,  supplies  and  equipment  leaving 
the  risk  areas  will  be  able  to  use  the  same  structures.  This  is  important 
to  avoid  duplication. 
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Fortunately,  the  emphasis  on  natural  disaster  can  be  on  transportating 
people  from  the  danger  areas  since  the  supplies  and  equipment  are  being 
transportated  from  safe  areas.  This  is  particularly  important  as  time  is 
short  in  this  type  of  evacuation. 

There  are  several  problems  which  are  clear  from  thinking  about  transportation 
in  preparedness  systems.  One  which  has  yet  to  be  formulated  is  from  pre¬ 
cisely  where  are  people  to  leave  the  high  risk  areas  to  be  transported  to 
the  shelters.  In  other  words,  in  case  of  nuclear  evacuation,  will,  say, 
those  leaving  by  autos  {probably  the  majority),  leave  from  home  or  from 
some  common  point?  If  people  are  to  leave  from  home,  then  a  plan  to  group 
various  homes  in  some  geographical  way  would  be  necessary.  This  puts  the 
emphasis  on  an  evacuation  done  in  stages,  i.e.,  people  leaving  by  area 
according  to  a  predetermined  time.  People  would  not  be  able  to  leave 
according  to  their  own  time  schedule.  To  put  it  another  way,  people  in  one 
area  will  be  instructed  to  leave  at  time  t^  and  those  in  another  area  at 
time  t2,  where  tj  t  t2-  This,  of  course,  should  help  to  futher  alleviate 
congestion  on  the  highways. 

The  immediate  problem  with  a  "brigade"  style  exodus  is  that  it  may  cause 
further  congestion  within  the  risk  area  by  having  autos  meet  at  one  central 
launch  point,  unless  all  other  vehicles  are  kept  off  the  road  (except 
emergency  vehicles  and  service  vehicles).  Furthermore,  even  without  any 
congestion,  timewise,  this  appears  inefficient.  The  extra  time  that  would 
be  needed  to  form  a  brigade  at  a  meeting  point  could  probably  be  better 
spent  elsewhere  in  the  relocation  procedure. 

The  literature  on  the  subject  of  transportation  systems  and  relocation 
planning  failsto  mention  just  how  the  movement  initiates.  Nothing  explicit 
is  made  known  on  whether  or  not  people  leave  by  autos  from  home  and  then 
drive  to  shelters  (along  predetermined  routes  and  times)  or  leave  home  by 
autos,  then  meeting  at  a  "launch"  point  (predetermined  also)  from  where 
the  "brigade"  drives  to  shelter.  Many  choices  need  to  be  made. 
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Equipment  and  supplies  that  will  be  transported  (decontamination  devices 
and  other  equipment  may  already  be  stored  in  the  host  areas)  will  leave  from 
warehouses  and  distribution  points  in  the  risk  areas.  It  is  also  assumed 
that  people,  especially  those  traveling  by  private  auto,  will  take  along 
some  supplies,  mostly  food.  However,  due  to  various  car  sizes  and  un¬ 
economical  packing,  the  private  transport  of  supplies  is  severely  limited. 
Those  who  travel  at  least  partly  by  air  or  rail  will  be  even  more  limited 
in  what  they  can  take.  Thus,  most  supplies  and,  in  particular,  food  and  water 
must  be  brought  to  the  shelters  from  distribution  points  in  the  host  areas. 

But  first,  food  and  water  must  be  transported  to  the  distribution  points 
(in  the  host  areas)  from  stores,  manufacturers,  and  other  distribution 
points  in  the  risk  areas.  This  is  worth  looking  at  more  carefully. 

According  to  Food  System  Support  of  the  Relocation  Strategy,  Vol .  I: 

Analysis  and  Case  Study  (Department  of  Defense,  DCPA,  1975),  92  U.S.  cities 
have  more  than  half  of  their  food  stocks  available  locally.  Of  these 
cities,  only  two  are  not  marked  as  primary  nuclear  attack  target  areas. 
Consequently,  these  areas  must  be  evacuated.  The  food  in  these  distribu¬ 
tion  points  must  be  transported  to  distribute  points  in  host  areas  and 
then  on  to  shelters.  This  implies  that  within  a  host  area,  there  is  a 
class  of  shelters  with  an  associated  system  of  warehouses,  or  distribution 
points  or  depots  from  which  equipment  and  supplies  are  obtained  by  the 
relocated  population.  This  appears  reasonable  since  limited  movement 
during  a  crisis  is  possible. 

The  above  discussion  gives  support  to  the  structure  of  the  transport  function. 
People,  equipment,  and  supplies  will  move  from  a  region  (actually  different 
points  within  the  region  at  certain  times)  to  a  host  area  with  the  equipment 
and  supplies  arriving  before  or  not  much  after  the  people  have  arrived. 

The  operation  acting  on  a  matrix  and  producing  a  matrix  is  in  some  sense 
natural . 

The  distribution  points  may  be  stocked  with  some  supplies  including  food, 
but  they  cannot  meet  all  the  needs  of  the  population  of  the  host  area  during 
an  attack.  Food  (especially  with  short  shelf  life)  must  be  brought  in  from 


the  distribution  points  of  the  risk  areas  during  the  relocation.  One  item 
which  presents  a  major  problem  is  water.  Due  to  the  weight  and  the  enormous 
quantity  consumed,  it  is  not  clear  what  is  the  most  efficient  way  of  meeting 
the  demands  of  the  relocated  population. 

In  addition  to  the  problems  of  deciding  the  best  roadway  network  (the  mean  - 
ing  of  "best"  includes  most  efficient  with  respect  to  time  and  distance 
traveled  from  a  region  of  risk  to  a  region  of  safety,  minimum  congestion, 
and  maximum  flow),  the  question  of  which  air  or  rail  terminals  that  will 
be  used  in  crisis  relocation  needs  to  be  examined.  The  major  terminals 
will  be  used,  but  it  is  not  clear  just  what  secondary  terminals  are  to  be 
functioning.  Also,  there  may  be  an  insufficient  number  of  air  or  rail 
terms  in  the  host  areas. 

Trains  stopping  for  passengers  at  many  minor  stations  would  be  time  consuming. 
In  terms  of  air  traffic,  it  must  be  determined  which  planes  are  to  fly  peo¬ 
ple  to  shelters  or  equipment  and  supplies  to  their  respective  destinations. 
Certain  military  and  commercial  airlines  (as  yet  unspecified)  will  do  much 
of  the  air  transporting.  Private  planes  may  transport  some  but  this  implies 
that  many  small  airports  are  functioning. 

The  point  is  that  traffic  flow  along  roads  by  rail  and  by  air  remain  smooth 
and  major  congestions  avoided.  Besides  planning  routes,  it  appears  likely 
that  plans  should  formulate  an  evacuation  by  stages.  Moreover,  a  method 
of  removing  stopped  cars  (accident  or  otherwise)  quickly  will  ensure  that 
highways  will  not  become  impassable. 

In  the  case  of  peacetime  transportation,  one  major  difficulty  is  the  short¬ 
ness  of  time  between  threat  of  disaster  and  evacuation.  In  fact,  there  is 
generally  little  or  no  warning  of  an  impending  disaster.  In  the  case  of 
adverse  bad  weather  or  flooding,  there  is  just  a  matter  of  hours  to  move 
people  from  the  area  of  danger.  Until  there  is  some  method  of  predicting 
earthquakes  accurately,  evacuation  must  come  after  the  initial  tremors. 

Thus,  the  transportation  system  has  to  be  one  that  can  be  put  into  effect 
with  only  a  very  short  notice. 
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Some  consideration  should  also  be  made  about  keeping  fuel  consumption  to  a 
minimum.  Fuel  must  be  conserved  during  relocation  so  that  there  will  be 
t  sufficient  quantities  for  movement  during  the  crisis  itself  and  for  postre¬ 

location.  Some  duel  will  be  stockpiled  at  distribution  points,  but  this  is 
limited.  After  a  nuclear  attack,  while  some  pipelines  may  not  be  damaged, 
the  refineries  and  storage  facilities  will  almost  certainly  be  destroyed. 

In  the  manner  in  which  the  transportation  system  is  specified  in  the  control 
map,  an  implication  is  apparent.  It  is  that  the  time  at  which  the  people, 
equipment,  and  supplies  begin  to  be  transportated  are  not  necessarily 
dependent  on  one  another.  As  was  mentioned,  this  may  not  be  entirely 
correct.  Thi  feasibility  of  a  "brigade"  must  first  be  fully  examined. 

A  brigade  syste:,  means  that  a  group  of  people  together  with  a  certain 
amount  of  supplies  and  equipment  would  be  transported  as  one  unit  to  the 
host  area.  If  this  is  the  case,  then  the  time  of  departure  and  the  launch 
point  would  be  the  same  for  all  from  a  particular  brigade. 

Another  possibility  is  -hat  the  times  are  related  in  some  way  but  not  the 
place  (launch  point).  In  other  words,  using  a  system  similar  to  a  brigade 
type,  at  a  particular  time  or  sequence  of  time,  people  and  their  corresponding 
equipmert  and  supplies  begin  movement  from  different  points.  This  trans¬ 
portation  system  appears  to  have  an  advantage  over  the  one  above  since 
movement  to  a  common  launch  point  is  eliminated,  i.e.,  movement  is  directed 
to  a  host  area  from  the  beginning.  This,  of  course,  saves  time  and  should 
certainly  not  add  to  any  congestion  that  might  already  exist. 

One  major  implication  of  the  relocation  during  a  nuclear  crisis  is  the 
radical  change  in  the  economies  of  the  world  and,  in  particular,  the 
country.  Immediately  upon  the  issuance  of  the  order  for  evacuation,  the 
present  economic  picture  would  be  no  longer  relevant. 

Several  problems  must  be  analyzed  in  detail.  One  is  in  what  ways  can  various 
industries  (also,  livestock)  be  protected  such  that  the  economies  after  the 
crisis  will  closely  resemble  the  pre-crisis  situation.  Another  concerns  economics 
during  the  relocation.  Finally,  what  would  post-crisis  economies  be  like? 

To  answer  this,  a  realistic  post-crisis  economies  model  must  be  made 
expl icit. 
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The  first  of  the  problems  falls  partly  under  the  transportation  system. 

During  the  period  of  relocation,  key  industries  (not  enumerated  here)  would 
be  relocated  in  the  sense  that  they  will  continue  to  function,  at  least 
partially,  during  the  period  of  relocation.  So  it  would  be  imperative 
that  the  workers  (not  necessarily  all)  of  these  key  industries  be  relocated 
to  the  same  sheltering  area.  Some  people  "who  can  do  the  job"  may  be  found 
living  in  the  host  area  and  that  would  ease  the  transportation  problem 
slightly.  What  is  important  is  that  these  industries  remain  vital  during 
and  after  the  crisis.  Similarly,  equipment  and  supplies  necessary  for  these 
industries  must  be  obtainable. 

Livestock  protection  must  be  taken  into  account,  too.  It  does  not  appear 
feasible  to  transport  livestock  during  a  crisis.  Fortunately,  a  considerable 
size  (figures  unavailable)  of  the  U.S.  livestock  is  located  in  the  plain 
states  and  not  in  the  more  vulnerable  coastal  regions.  The  idea  of  sheltering 
livestock  against  fallout  should  be  examined. 

As  soon  as  evacuation  begins,  some  sort  of  plan  must  be  put  into  action 

♦  for  the  monetary  system.  Banking  facilities  would  be  closed  or  rendered 
incapacitated  by  crowds.  But  will  money  be  necessary  at  this  point? 
Governmental  guidelines  may  make  it  possible  for  people  to  obtain  foodstuffs 
and  personal  supplies  from  local  stores  (not  distribution  points  or  ware- 

♦  houses)  on  a  rationing  basis.  Order  and  quickness  of  such  a  move  must  be 
guaranteed.  The  question  of  how  goods  (food  and  otherwise)  are  to  be 
distributed  during  life  in  the  host  areas  must  be  planned.  Some  sort  of 
rationing  system  is  the  most  obvious  candidate.  However,  future  work  will 

♦  show  if  such  a  proposal  would  be  effective,  and,  if  so,  how  it  will  operate. 

It  is  far  too  early  to  say  much  about  economic  life  after  a  nuclear  crisis. 
Needless  to  say,  things  will  be  quite  different  than  before  the  attack. 

♦  Shortages  will  certainly  occur,  food  stored  in  distribution  points  will  be 
low  (if  not  depleted),  livestock  killed,  refineries  and  fuel  storage  areas 
destroyed,  factories,  offices,  hospitals,  schools  also  damaged.  This  and 
more  will  put  a  severe  strain  on  any  economic  system.  However,  within  cer- 

♦  tain  parameters  (not  specified  here,  but  will  include  size  of  surviving 
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population,  extent  of  damage),  an  economic  model  can  be  constructed.  Only 
after  such  a  model  is  formulated,  can  the  success  of  the  transportation 
system  be  truly  evaluated. 

As  can  easily  be  seen,  much  work  on  the  transportation  system  within  a 
preparedness  system  remains.  Hopefully,  this  report  has  shown  where  some 
problem  areas  are  and  how  they  may  be  solved.  This  discussion  of  problems 
and  implications  does  not  exhaust  the  possibilities.  In  fact,  it  shows  that 
other  major  systems  (e.g.,  economics)  need  to  be  researched  so  that 
preparedness  systems  can  be  fully  specified. 
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COMMUNICATION  CENTERS  LOCATION 


The  point  of  departure  of  this  paper  is  Clifford  E.  McClain's  paper  [1] 
"Objectives  for  Preparedness  and  Their  Implications  for  Civil  Defense 
Design  Options,"  where  he  gives  the  functional  characteristics  of  a  civil 
defense  system  (that  is,  those  end  functions  of  the  system  that  determine 
its  overall  worth  and  effectiveness): 

•  reduction  of  the  targeting  efficiency  of  the  threat, 

•  good  false-alarm  tolerance, 

•  continuity  of  emergency  services,  and 

•  enhanced  recovery  capability. 

If  the  civil  defense  system  is  to  function  in  any  adequate  strategic  sense, 
it  is  absolutely  obvious  that  it  must  satisfy  these  necessary  principles. 

To  define  such  a  system,  it  is  necessary  to  ensure  that  efficient  communi¬ 
cation  between  the  elements  of  the  national  civil  defense  structure  be 
preserved.  Once  a  reliable  communication  system  is  designed  to  meet 
performance  criteria,  it  is  then  necessary  to  study  its  behavior,  efficiency, 
and  reliability  in  terms  of  the  functional  requirements.  We  consider 
the  functional  requirements  defined  and  discussed  by  Clifford  McClain  as 
being  the  goals  of  the  communication  system.  The  compatability  of  our 
communication  model  with  his  functional  requirements  is  ensured  by  both 
sharing  common  performance  criteria. 

In  his  paper,  McClain  proposed  a  probabilistic  model;  our  model  is  based 
on  a  fuzzy  approach  [2],  which  can  deal  effectively  with  human- 
based  data.  The  question  that  we  want  to  answer  in  this  paper  is  what  is 
a  good,  efficient  way  of  using  the  communication  centers  in  a  given  region 
by  the  set  of  individuals  involved  in  the  process  of  communication?  Given 
the  goals  of  a  communication  system  as  defined  by  the  functional  requirements, 
we  believe  that  the  location  of  the  communication  centers  and  their  access- 
ability  is  a  basic  problem  towards  achieving  these  goals.  We  have  developed 
a  theoretic  model  of  communication  [3],  and  we  intend  to  study  in  the 
future  its  compatability  with  the  functional  characteristics  of  the  civil 
defense  system. 
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Given  a  set  of  individuals  and  a  set  of  communication  centers  distributed 
over  a  given  region,  a  fuzzy  mathematical  model  is  proposed  to  foresee  the 
clustering  of  the  population  in  the  subsets  of  individuals  using  the  same 
communication  center.  The  problem  is  developed  by  modeling  a  fuzzy  algorithm 
of  the  human-decision  process. 

We  assume  that: 

1.  Each  individual  has  the  possibility  of  communication. 

2.  Different  levels  of  communication  procedures  exist,  where  higher 
levels  indicate  more  specialized  services  (i.e.,  less  frequent 
demand). 

Therefore,  centers  of  communication  and  users  are  classified  in  levels  with 
the  following  qualifications.  Any  center  of  communication  offers  at  the 
same  time  all  the  services  of  a  level  lower  than  its  own  and  controls  them 
(HOS  control  maps).  Any  user  may  demand,  ask  questions  and  request  services 
up  to  his  own  level.  It  is  therefore  possible  to  imagine  a  mathematical 
model  as  a  fuzzy  algorithm,  as  follows. 

Users  choose  among  all  the  available  communication  centers,  some  which  are 
reasonably  located,  corresponding  to  their  needs,  accessibility  requirements, 
etc.  Therefore,  communication  centers  should  be  located  close  to  the  place 
where  the  user  is  located  at  the  moment  when  he  needs  to  communicate.  The 
further  away  a  communication  center  is  located  from  the  user's  location,  the 
more  difficult  it  is  for  him  to  use  it.  In  an  emergency  situation,  it  is 
obvious  that  the  individual  will  wish  to  minimize  any  inconvenience.  A 
user  would  like  to  satisfy  all  of  his  needs,  or  at  least  most  of  them,  at 
the  same  communication  point,  but  sometimes  he  can  choose  to  act  on  different 
levels.  We  are  considering  that  his  demand  for  lower-level  services  is 
more  frequent. 

Communication  points,  reasonably  located,  can  be  expressed  by  associating 
to  each  user  a  fuzzy  set  of  the  centers  reasonably  located.  Let  us  con¬ 
sider  first  a  user  who  needs  to  talk  to  a  given  level  p.  His  decision 
is  modeled  by  the  product  of  the  fuzzy  set  of  reasonable  communication 
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center  location  by  the  fuzzy  set  of  not  "too  crowded"  centers.  It  is  important 
to  take  into  account  the  degree  of  "crowdedness",  because  in  the  case  of 
a  disaster  when  the  problem  of  relocation  is  critical,  different  users,  for 
example,  may  ask  the  same  communication  center  to  allocate  vehicles  for 
transportation. 

The  decision  of  the  individual  as  to  whom  to  talk  to  will  be  expressed  by 
a  fuzzy  set  over  the  centers  of  communication  set.  The  services,  or  the 
answers  that  the  user  gets,  are  classified  in  k  levels.  A  user  of  level 
p  _<  k  asks  for  an  answer  up  to  the  level  p. 

Users  are  partitioned  into  a  class  X  of  n  subsets  x,  where  each  subset 
x  e  X  contains  all  the  users  who  are  located  in  the  same  compact  place 
(that  is,  geographically  at  the  same  place).  Each  subset  x  is  characterized 
by  a  k-dimensional  vector  (y)  whose  p'th  components  gives  the  number  of 
users  belonging  to  x,  whose  highest  demand  level  is  p.  The  set  of  the 
communication  centers  is  denoted  by  Y  and  is  assumed  to  contain  n  elements  y. 
The  set  Y  is  subdivided  into  k  disjoint  subsets  Yp  (p  =  1,  2,  ...  k) 
according  to  the  highest  level  of  the  type  of  service  (communication) 
offered.  Each  communication  center  y  is  characterized  by  a  k-dimensional 
vector  C(y),  whose  p'th  component  gives  the  number  of  users  who  demand 
services  at  the  level  p  from  y. 

Then,  a  function  yy  (C(y))  is  given  for  each  y  e  Y,  which  gives  the  member¬ 
ship  value  of  y  in  the  fuzzy  set  A  C  Y  of  the  "not  too  crowded"  centers. 

Then,  according  to  different  service  levels,  the  fuzzy  set  A  is  partitioned 
into  the  fuzzy  subsets  Ap  (p  =  1,  2,  ...  k). 

Let  B  be  the  fuzzy  set  contained  in  X  x  Y  whose  elements  (x,y)  represent 
a  supply  communication  center  y  reasonably  located  with  respect  to  the 
demand  center  x.  Let  u(x,y)  be  the  membership  function  of  B. 

For  x  e  X,  fixed,  y(x,y)  defines  over  Y  the  fuzzy  set  Bx  of  the  communication 
centers  reasonably  located  with  respect  to  x. 


Let  us  now  consider  a  user  of  level  p  belonging  to  x.  For  each  level  J  <  p 

of  his  demand,  his  decision  is  modeled  by  the  following  fuzzy  set  D  .  with 

xpj 

the  membership  function  yxpj(y). 


°xpj  ■  Bx<Ak'JAk-lU"-UAp> 

Dxp(p-1)  s  Dxpl  tBxAp-l5  “’“"V 

Dxpj  ■  °xpU+,)  (BxAj>  “  a  =  maxpXp(j  +  l)(y) 


where  AB  denotes  the  algebraic  product  of  the  fuzzy  sets  A  and  B. 

(u(y)  =  ua(y)  Mb(y)),  A  B  denotes  the  union  of  the  fuzzy  sets  A  and 
B  (u(y)  =  max  (ua(y),  ub(y)),  and  (A)a  is  the  fuzzy  set  defined  by  the 
membership  u(y)  such  that 

y(y)  =  ua(y) »  ya(y)  >  a 

u(y)  =  0,  a(y)  <  a 

Assume  that  the  users  of  level  p  apply  to  y  for  services  of  level  y  (j  <  p) 
with  a  probability  W-  (x,y)  proportional  to  u  .. 

J  “  Xpj 


By  definition,  we  assume  W.  (x,y)  =  0  when  j  >  p,  let  W(x,y)  be  the  k  x  k 

J  r 

matrix  consisting  of  the  elements  W.  (x,y).  The  vector  obtained  by 

J  r 

W(x,y)  •  D(x) 

expresses  the  expected  value  of  users  x  of  whom  apply  to  y  for  each  "service" 
level.  Therefore  the  expected  value  C(y)  of  all  users  applying  to  y  is: 
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C(y)  =  Z  W(x. ,y)  D(x.) 

i  =  l  1  1 

xi  I  X. 


All  these  definitions  allow  us  to  obtain  the  solution  to  the  clustering 
problem. 

Discretion  (1)  requires  that  the  vector  C (y )  be  known  in  order  for  it  to 
be  possible  to  compute  the  membership  function  of  A.  (2)  C(y)  is  obtained 

by  _  only  at  the  end  of  the  computation  process.  The  solution  could 

be  obtained  by  the  following  iterative  procedure. 

Assume  an  initial  tentative  value  Cg(y)  of  the  distribution  of  users  among 
all  the  centers  of  communication  y,  developing  the  computations  from  1  to  4 
a  new  user  distribution  C  "'(y)  is  obtained.  Therefore,  if  C Ay)  is  equal 

1  u  0 

to  CQ  (y),  then  it  represents  a  problem  solution.  On  the  contrary,  a  new 
tentative  value  can  be  defined 

Cx(y)  =  cQ(y)  +  HC0\y)  -  CQ(y)] 

where  a  suitable  small  value  of  F  is  given  the  convergence  could  be  proved 
in  the  assumption  that  the  infinitesimal  variations  of  the  tentative  value 
of  C(y)  do  not  produce  finite  variations  of  the  resulting  value  C^(y). 

Fuzzy  Set  of  Reasonably  Located  Centers 

Considering  the  demand  center  (point)  x  and  an  answering,  or  service  center 
y,  on  the  basis  of  good  and  objective  data,  the  effort,  time,  money,  etc. 
for  operation  can  be  evaluated. 

Let  C(x,y)  be  the  evalution  of  the  effort  (time,  money)  effected  by  a  user 
x  who  used  y.  The  membership  y(x,y)  of  the  fuzzy  set  B  is  defined  as  a 
function  of  C(x,y)  depending  on  parameters  that  have  to  be  evaluated  by 
considering  both  the  local  usages  and  the  effort  spent  for  the  considered 
service. 
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Therefore,  we  many  consider: 


(x,y)  =  p-(£i*^-)B 

C0 

CQ  is  a  parameter  that  evaluates  the  effort  at  which  membership  value  is 
0.367.  It  is  a  scale  factor.  iB  influences  the  transition  rate  of  the 
membership  from  1  to  0.  It  allows  us  to  consider  the  local  usages.  In 
fact,  larger  values  of  B  correspond  to  a  general  agreement  among  users 
to  consider  as  reasonable  "trips"  of  relatively  big  effort. 


Fuzzy  Sets  of  Non-crowded  Communication  Centers 

Crowded  communication  center  is  defined  by  an  individual  waiting  in  a  line. 
Example:  twin  evacuation 

Two  factors  have  to  be  considered:  (1)  the  mean  waiting  time  that  can  be 
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effectively  evaluated,  and  (2)  the  users  impatience,  anxiety,  etc.  depending 
on  the  local  situation. 

Let  us  have  the  vector  C(y)  of  the  users  of  a  communication  center  y,  and 
knowing  the  center  capacity,  the  mean  waiting  time  can  be  evaluated;  let  it 
be  Cj.(y).  The  membership  of  the  fuzzy  set  A  can  be  defined  by  a  function: 

uy(c(y))  =  p  {f- - )  k 

K0 

The  measuring  of  and  B.  is  as  above,  but  we  use  different  values. 

K0  K 

The  model  is  interesting  because  it  models  the  human  behavior  by  a  fuzzy 
process,  and  also  we  consider  the  "crowding"  of  the  communication  centers. 
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